Connect code repositories
The Core app in Vulkro Cloud scans your code repositories with the same
analysis as the vulkro scanner, on the
branches you track.
Connect a repository
- Open Connect a Repository in the Core app and pick the host.
- Give Vulkro read access:
- App (when your workspace offers it): install the Vulkro GitHub App and choose the repositories, or sign in to GitLab or Bitbucket. No token to create.
- Access Token: create a token on the git host for that one repository (table below), paste it with the repository address, and click Check Access.
- Pick branches (the default branch is always tracked), set a name, an Environment and a Criticality, and choose whether to scan now.
A public repository needs no token, but without one Vulkro Cloud cannot report on pull requests. Tokens are stored encrypted, per repository, and never shown again; replace one in the repository's settings.
What the token needs
| Host | Token | To scan | For pull-request checks |
|---|---|---|---|
| GitHub | Fine-grained personal access token, only select repositories | Contents: Read-only | Commit statuses and Pull requests: Read and write |
| GitLab | Project access token | Reporter, read_repository and read_api | Developer, api |
| Bitbucket | Repository access token | Repositories: Read | Pull requests: Write |
| Other / Self-Hosted | Read-only token from your git server | Read contents | Not supported |
Fix pull requests also need write access to contents (GitHub: Contents, Read and write).
Hosts
- github.com, gitlab.com and bitbucket.org.
- Other / Self-Hosted (including self-hosted GitLab or Bitbucket Data Center), on Business and up. It must be reachable over HTTPS on a public DNS name. Pull-request checks and scan on push do not work there; it scans on its schedule and on demand.
Addresses must be https:// with no credentials in them. SSH and git://
are refused. How many repositories and branches you can connect depends on
your plan.
What a repository shows
| Area | What it shows |
|---|---|
| API & Access | Endpoints, API Spec coverage, Access Matrix, Protocols |
| Data Flow | Data Flow, Data Lineage |
| Database | Tables, Columns, Relationships (see Database schema) |
| Code graph | Structure, Imports, Impact, Files |
| Secrets | Secrets in the code and in git history |
| Dependencies | Dependencies, Vulnerabilities, Licences |
| Code Health | Hotspots, Test Coverage, Rules |
| Attack Paths | Paths from an entry point to a flaw |
What Vulkro Cloud does with it
- Clones the branch read-only and shallow into a scan container, and deletes the clone when the scan ends.
- Reads
CODEOWNERSto set issue owners. - Writes back only what you turn on: statuses, comments and annotations on pull requests, and fix pull requests when you ask for one.
Next: Scans, branches and gates.