A commit appears only on white-box scans, because only they clone a repository and read its code. A black-box scan tests the live URL and has no commit. If you expected one, check that the target has a repository URL and uses a white-box scan.
Why this happens
A white-box scan clones your repository at launch and records the commit it read. The scan page then shows it in the subtitle, as in Profile: full test · Commit de872ce3f5, and again in the Run details card as the full commit ID.
With no repository, a black-box scan has nothing to record. Its subtitle reads Profile: name · Manual run · Scan plus the scan ID, and the Run details card has no Commit row.
How to fix it
This is expected for black-box runs. To get a commit on your scans, follow these steps.
- Open Targets and click the target.
- Look for a repository URL on the target page. A target with no repository is black-box.
- Add a new target and choose white-box, then enter the repository URL over HTTPS and the branch. Targets cannot be edited.
- For a private repository, save a Git token under Settings → Git Access.
- Next, make a profile for the new target, press Scan, and open the finished scan to find the commit.
Still not working?
- SSH addresses are not supported, so use an HTTPS repository URL.
- Check that the scan belongs to a profile on the white-box target, not the old one.
- Send the scan ID to /contact if a white-box scan still has no commit.
Also read how to find the commit a scan analysed.
Related questions
- How do I see which commit a white-box scan tested?
- Why does Lines of code show a dash on my scan?
- What's the difference between a white-box and a black-box target?
- Why doesn't my CI-triggered scan show a commit?
- What does "No repository configured — add a Git repository URL to run a scan." mean?
White-box vs black-box scans: how to choose a scan type in Cyberlop
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.