My white-box target asks for a Main URL even though you have the code. Why?

Why this happens

The documentation says a scan needs two things: a target, which is the running URL plus a git repository to clone, and a scan profile. Cyberlop first analyses the code, then maps the live app, then tests what the code suggests. The form describes the Main URL as "the primary URL scans run against". Code alone cannot show whether a weakness really works in the running app.

How to fix it

1. On Targets, click + New target.
2. Type the address of the running app, such as https://staging.example.com.
3. Pick the White-box card and add the Repo URL (HTTPS).
4. Put any API or admin hosts in Backend / additional URLs.
5. Click Create target.

The pairing of code and live app is why white-box findings can name a file and line and also carry live proof, such as the request, the response and a screenshot.

Still not working?

A staging copy of your app that runs the same code as the repository works well. If the URL runs different code, code and live results will not match. If you have no running instance at all, see how to turn off the exploitation phase, but the form still asks for the URL. Read the scan types and the five phases. For anything else, use the contact page.

Related questions

• What's the difference between a white-box and a black-box target?
• How do I add a new target?
• What is Cyberlop and what does it test?
• What are the five phases of a Cyberlop scan?
• The New target dialog says a repo URL is required, but my app has no repository. What do I do?

Full tutorial

How to add a target in Cyberlop: the New target dialog, field by field

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre