How do I scan a private repository?

Public repositories clone with no setup. A private one needs a token so Cyberlop can read it. The token only reads your code, and Cyberlop never needs more than that.

Steps

1. On your code host, create a token with read-only access to the repository. Cyberlop only clones, so it needs nothing more.
2. In Cyberlop, open Settings and choose Git Access.
3. Paste the token into Replace token. In Allowed hosts, list the domain of your code host.
4. Click Save Git settings, then Verify.
5. Create a white-box target. Enter the HTTPS address in Repo URL (HTTPS), and set the Repo branch.
6. Open a profile on that target and press ▷ Scan.

Good to know

You can also save a personal token. Go to My Account, paste it under Personal Git token (private repo cloning), and click Save Git token. Cyberlop uses your personal token first for scans you launch. It falls back to the organisation token if you leave yours unset.

• Cyberlop sends the token only to the allowed hosts, so a repository on any other host is cloned without it, as if it were public, and that clone fails if the repository is really private.
• SSH addresses that start with git@ do not work. Use HTTPS.
• Secrets stay encrypted at rest and never appear again after you save them, so keep your own copy somewhere safe.

If the clone still fails, read what a private repository needs. Questions about how Cyberlop handles your code? See /security or write to /contact.

Related questions

• My private repository won't clone. What do I need?
• Why is my repository being cloned without my Git token?
• Why isn't my git@ SSH repository URL accepted?
• The token field stays blank after saving. How can I tell whether my Git token saved?
• How do I connect a Git repository to a target?

Full tutorial

Git access in Cyberlop: set a read-only token and allowed hosts

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre