Skip to main content

Connected Repositories

Path: /code/repositories · Sidebar: Code Security

Connect your source repositories so apPosture can run the code engines (SAST/SCA/secrets/IaC) and power gray-box dynamic testing - using the source to make DAST smarter.

Connecting a repo​

  • OAuth / token - link GitHub / GitLab via Integrations; apPosture clones into a contained source sandbox (path-traversal-safe).
  • Direct upload - the CI agent ships the working tree per run (no standing connection needed).

Each repo maps to one Application by its normalised clone URL (not display name), so the same repo never splits across services.

What it unlocks​

  • Code scanning - SAST, SCA, Secrets, IaC over the real source.
  • Gray-box DAST - source-derived routes/endpoints feed the dynamic scanner, so it tests the actual attack surface, not just what a crawler finds.
  • Multi-repo products - a microservice's source route (/orders/{id}) maps to its live gateway path (/api/orders/{id}) via a route prefix.
  • Threat models - source + IaC ground the architecture.
  • Precise fixes - file:line locations and committable fix suggestions.

Per-repo controls​

  • Branch selection and re-sync (HEAD commit recorded per sync).
  • Per-repo webhook secret for zero-pipeline scanning.
  • Scan defaults inherited from the application.

Browse a connected repo's findings and code map from its detail page.

Last updated on