Why is my repository being cloned without my Git token?

Why this happens

This is a safety rule, and the help text explains it: the token "can never leak to an arbitrary repo URL." It goes only to the allowed hosts, while a repository on any other host is "cloned without it (treated as public)."

So a target that points at an unlisted host, or one with a typo in the host name, clones with no credentials. A public repository loses nothing this way. With a private one, the clone fails, and the failure can look like a token problem when the real cause is the host list.

How to fix it

1. Open the target and note the host part of the Repository address, for example git.example.com.
2. Go to Settings → Git Access.
3. In Allowed hosts, add that domain. Separate several hosts with commas.
4. Click Save Git settings, then Verify.
5. Press ▷ Scan again.

Still not working?

• Check the spelling of the host in both the target and Allowed hosts.
• Leaving the token field blank keeps the stored one, so paste a new token only when you mean to replace it.
• Cyberlop tries a personal token from My Account first for scans you launch.
• The repository address must use HTTPS, because SSH is not supported.

Read what a private repository needs for the full list, or ask us through /contact.

Related questions

• My private repository won't clone. What do I need?
• How do I scan a private repository?
• The token field stays blank after saving. How can I tell whether my Git token saved?
• Why isn't my git@ SSH repository URL accepted?
• Can Cyberlop change anything in my repository?

Full tutorial

Git access in Cyberlop: set a read-only token and allowed hosts

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre