Home / Help centre / Workspace settings
Workspace settings
What permissions should my Git token have?
Use a read-only token. Cyberlop only clones your code, so grant read-only repository access to all branches. On a fine-grained token that means Contents: Read-only. On a scope-based token it means read_repository or the Reporter role.
The short version
Give it read-only access to repositories, and nothing more. Cyberlop only clones your code, so a token that can read it is enough. A token that can write is a risk you do not need.
How it works in Cyberlop
The warning box on Settings → Git Access sums it up: use a read-only token. Grant read-only repository access to all branches. Private and public repositories are both fine.
| Kind of token | Permission to grant |
|---|---|
| Fine-grained token | Contents: Read-only |
| Token with scopes | read_repository, or the Reporter role |
Two more controls protect the token. The first is Allowed hosts. Cyberlop sends the token only to the hosts you list, so it can never reach an arbitrary repository URL. Cyberlop clones a repository on any other host without the token and treats it as public. The second is storage: Cyberlop keeps the token encrypted and never shows it again after you save it.
Clones use HTTPS only. SSH addresses (the git@ form) are not supported, so paste an HTTPS repository URL when you add a target. If you scan a public repository, no token is needed at all, because public repositories clone at launch.
What to do next
Create the token with the narrowest permission your code host offers, paste it into Replace token, and list your code host in Allowed hosts. Click Save Git settings, then Verify.
Details live in adding an organisation Git token and limiting the hosts that get the token. The idea behind it is least privilege.
Related questions
- How do I add an organization Git token for private repositories?
- How do I limit which hosts the Git token is sent to?
- How do I check that my Git token works?
- How do I add my own personal Git token?
- Could my Git token be sent to a repository host I don't control?
Git access in Cyberlop: set a read-only token and allowed hosts
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.