How do I see which commit a white-box scan tested?

Steps

Each white-box scan clones the repository at launch and tests that code, so the commit tells you exactly which version was read.

1. Go to Recent Scans. Choose it in the sidebar.
2. Click the white-box run. The detail page opens.
3. Read the subtitle. It shows Commit and a short ID.
4. Open Overview. Find Commit under Run details.
5. Copy the SHA. Use it in your code host.

Good to know

The subtitle looks like Profile: full test · Commit de872ce3f5 · Scan d667c35d. The Overview card shows the complete SHA. Paste it into your code host to see the exact files.

The Activity page records the short commit on a Start · Scan entry for white-box runs. In CI, the job can pass a commitSha when it triggers the scan.

No commit on the page? Black-box runs never read a repository, so they have none. Read why a scan shows no commit for the other cases.

Why the commit matters

A finding points to a file and line, and those lines belong to one version of the code. Knowing the commit lets your team open that exact version, fix the code on a branch, and compare it with the commit of the next scan. It also settles arguments about which build was tested.

Keep in mind that a scan clones the latest code on the branch at launch. If your team pushed a commit a minute later, the scan still tested the earlier one. The ID makes that clear. No guessing.

Related questions

• Why is there no commit shown on my scan?
• Where do I see how many lines of code a scan analysed?
• What does the trigger badge, such as Manual, mean on a scan?
• How do I open the profile a scan used?
• Where do I see how much a scan cost and how many tokens it used?

Full tutorial

The scan detail page: how to read a Cyberlop scan from Overview to Diff

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre