Skip to main content

Source Code

When you connect a Git repository or upload source code, you analyze everything from code to dependencies, secrets, infrastructure code, and components together in a single service.

  • Analyses : SAST · SCA · Secret · IaC · SBOM / License
  • What you need : Repository URL and access token (PAT), or a source code ZIP upload
  • Baseline : The branch selected at registration. Rescans automatically compare against previous results
  • Automation : Trigger scans on push/merge via CI webhook

What you need​

Choose Git repository connection, ZIP upload, or both. Multiple selections are allowed.

  • Connect a Git repository : the repository URL (for example, https://gitlab.example.com/team/app.git) and a read-only personal access token (PAT) for the repository.
    • Registration requires passing the authentication test, so enter a token even for public repositories.
  • Upload source code : if connecting a repository is difficult, upload your source code as a ZIP file. Handy for air-gapped networks or one-off checks.
Use least-privilege tokens

Read-only (read repository) permission is enough. Do not use tokens with broader permissions than needed. Stored tokens are kept encrypted and are shown masked on screen.

Registration steps​

On the [Services] page, click Register service and select Source code to start the wizard.

Select the Source Code typeSelect the Source Code type
Step 1 : Pick Source Code as the target type to register.
  • SAST : code-level vulnerabilities (static analysis)
  • SCA : known CVEs in open source dependencies
  • Secret : hardcoded keys · tokens · passwords
  • IaC : misconfigurations in infrastructure code within the repository (Terraform · K8s · Dockerfile)
  • SBOM · License : component inventory and license risk
Service info and analysis typesService info and analysis types
Step 2 : Name the service and select the analysis types to run.
Connect the sourceConnect the source
Step 3 : Enter the Git repository URL and Git Token, then press Authentication test. Once connected, select the branch to analyze (the default branch is preselected; required). The branch cannot be changed after registration. You can also add, or instead use, a ZIP upload.

When you finish, you land on the [Services] list. Open the service and press Run analysis in each analysis tab to start the first scan.

Branches and rescans​

  • Analysis is based on the branch selected at registration.
  • When code changes, it is scanned again and compared against previous results. If an item you marked as resolved is found again, it automatically returns to open and is marked as Recurred.
  • To run automatically on a regular basis, you can configure a scan schedule (cron).

CI integration​

To run SAST, SCA, Secret, IaC, and SBOM automatically on push or pull request, set it up as follows.

  1. Issue a token in the service's [Settings] > Automation > CI triggers tab.
  2. Add a scan trigger step to your pipeline.

Inject the token only as a CI secret variable and never put it in commits in plaintext. The setup steps and GitLab / GitHub / Jenkins snippets are covered in CI Integration.

Settings (changing after registration)​

After registration, you can change settings under [Settings] in the service sidebar (analyses, replacing the Git repository URL and token, replacing the ZIP). Step-by-step instructions are in Source code settings.