Home / Help centre / Security & privacy
Security & privacy
What happens to my source code after a cloud scan?
A cloud scan clones your repository only while it runs. Cyberlop wipes the clone at the end, whether the scan completes, fails or stops on cancel. Nothing carries over to the next scan. Relevant code excerpts go to your chosen AI provider over HTTPS.
The short version
The clone is temporary, and it exists only so the agents can read your code while the scan is running and for no other purpose. Cyberlop copies your repository into an isolated workspace, scans it, then deletes the copy when the scan ends. The next scan starts from a fresh clone, so an old copy never lingers on the platform between runs.
| Moment | What happens to the code |
|---|---|
| Scan starts | Cyberlop clones the repository, mounted read-only |
| Scan runs | Agents read it inside an isolated, temporary container |
| Completed, failed or cancelled | Cyberlop wipes the clone |
| Next scan | Starts from a new clone, with nothing cached |
How it works in Cyberlop
The Security page puts it in one line. Cyberlop clones the repository for the duration of the scan only, and wipes it at a final state. The documentation adds that nothing stays cached across scans. Your repository sits read-only inside its own container while the agents work.
Your Git token plays a small part. Cyberlop hands it to git for each call and never writes it to disk.
One more flow matters. During analysis, relevant code excerpts go over HTTPS to the AI provider your organisation chose, and if that is a concern for your review, read whether your code is sent to an AI provider for the details.
The scan record stays after the clone is gone. Findings keep their file and line, and deleting a scan removes its workspace while the findings of the target stay in place for you to triage later.
What to do next
- If code must never leave your network, use a scan agent instead of the cloud.
- Learn how scans stay apart in scan container isolation.
- Check what you can remove in deleting scans, targets and data.
Need a written answer for a review? Ask through /contact.
Related questions
- Does my code leave my network when I use a scan agent?
- Is my code sent to an AI provider?
- Is each scan isolated from other scans?
- Can Cyberlop change anything in my repository?
- Can I delete scans, targets and data whenever I want?
Cyberlop self-hosted scan agents: scan private apps from inside your network
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.