My app is only reachable inside our network, so cloud scans can't reach it. What do I do?

Why this happens

By default a scan runs in the Cyberlop cloud. The platform clones the repository and reaches the live URL from Cyberlop's own infrastructure. An app on a private network, or a repository behind a VPN, is out of reach from there, so the scan cannot start against it no matter what the profile says.

How to fix it

1. Go to Settings and open Scan agents. Click Add agent and give it a name.
2. Cyberlop creates the agent in a pending state. It shows a one-time enrolment token and a ready-to-run docker run command. The token is shown once, so copy it now.
3. Run the command on a machine inside the app's network. It needs Docker and outbound HTTPS.
4. Wait for the agent to turn online in the UI. On first start it trades the one-time token for a durable key and then begins polling Cyberlop for queued work.
5. Edit the scan profile. Under Scan location, choose your agent instead of Cyberlop cloud (default), then save.
6. Press Scan. The scan now runs on your network.

Good to know

Question	Answer
Inbound ports?	None. Only outbound 443 to app.cyberlop.com.
Where does code go?	It stays on your network.
Same pipeline?	Yes, the same five phases as a cloud scan.

An offline agent must be online before a scan can run. Each online agent also adds capacity to your concurrent scan limit.

Still not working?

• A pending agent has usually not been started on the machine yet, or cannot reach the internet on port 443 from inside your network.
• An agent stuck in pending has not started yet. See why an agent stays pending.
• An agent showing offline stopped sending heartbeats. See why an agent shows offline.

Need help with the network side? Contact us. The full walkthrough is in the scan agents tutorial, and the private scanning page explains the idea.

Related questions

• What is a self-hosted scan agent, and when do I need one?
• How do I add a self-hosted scan agent?
• How do I make a profile run on a self-hosted scan agent instead of the cloud?
• What network access does a scan agent need?
• Does my code leave my network when I use a scan agent?

Full tutorial

Cyberlop self-hosted scan agents: scan private apps from inside your network

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre