Home / Help centre / Integrations & API
Integrations & API
Can I scan a specific commit instead of the latest one?
In CI, yes. POST /api/ci/scan accepts an optional commitSha, and the job generated on Integrations sends the commit that triggered the pipeline. A scan started from the app uses the target's repository and branch instead.
The short version
In a pipeline, yes. You can send a commit with the trigger call. In the app, a scan follows the repository and branch on the target.
How it works in Cyberlop
The API reference lists an optional commitSha on POST /api/ci/scan. The ready-made jobs on Integrations fill it for you. The workflow version sends the commit of the run, and the pipeline version sends the commit variable that your CI sets.
A white-box target stores a repository URL and a branch, with main as the default. When you press Scan in the app, there is no commit field, so the scan reads that branch.
| Where you start the scan | What it scans |
|---|---|
| The app, with the Scan button | The repository and branch saved on the target |
| CI, with the generated job | The commit you pass as commitSha |
The product pages do not describe how a scan treats the commit after it arrives, and they do not say what happens with a commit that does not exist on the branch. Treat the field as the way to tell Cyberlop which commit your pipeline is building, and check the scan's results to confirm what you expected.
What to do next
- Use the generated job as it is, so the commit travels with every run.
- Open the finished scan and read the locations on the Findings tab. White-box findings point to a file and line.
- If a result does not match your commit, send us the scan and the SHA through the contact page.
Read how to trigger a scan from CI for the whole flow, or when the generated workflow runs to see which events start it.
Related questions
- How do I trigger a Cyberlop scan from my CI pipeline?
- Can I trigger a CI scan by profile name instead of profile ID?
- When does the generated CI workflow run?
- How do I copy the ready-made CI workflow for my code host?
- How do I launch a scan through the API?
How to add security scanning to your CI/CD pipeline
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Wiring it into your pipeline?
Share what you are building and we will help you set up the right token, profile and job.