Why did my scan test the main branch instead of my feature branch?

Why this happens

The New target dialog has a Repo branch field with the default main. If you leave it alone, scans read main. The target page says that scans clone the latest from the repository at launch. Cyberlop does not guess a branch from your pushes, so a feature branch never gets scanned unless a target names it.

How to fix it

1. Open the target. The Target details card shows Repository and Branch.
2. On Targets, click + New target and use the same Main URL and Repo URL.
3. In Repo branch, replace main with your feature branch name.
4. On the new target, click + New profile and save it.
5. Click Scan and check the Commit on the scan detail page.

Targets are immutable. There is no edit button, and the trash icon says to delete and recreate to change settings. Deleting a target also removes its profiles, schedules, scans and findings, which is why adding a second target is the safer move. Point the new one at the feature branch, and keep the first one for main.

Still not working?

The Main URL needs to run the feature branch too. If it serves other code, the code findings and the live findings will not line up, and that makes the results hard to trust. For more, see how to scan a non-main branch and why targets cannot be edited. Questions? Use the contact page.

Related questions

• How do I scan a branch other than main?
• What does it mean that targets are immutable?
• How do I change a target's URL or repository after creating it?
• Does Cyberlop scan the latest code from my repository each time?
• How do I connect a Git repository to a target?

Full tutorial

Connect a repository to Cyberlop for white-box scans

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre