Skip to main content

​
Overview

Use Repositories to review the primary scanned assets in Cysmiq. Repository views connect VCS metadata, scan activity, vulnerabilities, branch and tag refs, manifests, packages, and repository-level settings. Repositories are synced from your VCS integrations. Scans run against repository assets.

​
When to use repositories

  • Find scan status and the most recent scan for a repository
  • Review active vulnerabilities for a repository
  • Compare default branch scope with all branch scope
  • Inspect branch and tag refs
  • Export a repository SBOM
  • Configure repository-level scanning and ownership settings

​
Repository list

The Repositories list shows repository name, organization, type, scan status, active vulnerability counts, open technical impacts, last scan, and row actions. Use the list to filter by:
  • Repository name
  • Availability: Available by default, Orphaned, or All
  • Scan status
  • Repository type, including private, public, and monorepo repositories
  • Organization
  • Package, package version, manifest, or usage drilldowns opened from package and manifest views
The default Available filter hides repositories that are no longer present in the connected VCS provider. Select Orphaned or All when you need to find those repositories. Select one or more rows to export repositories. If available to your role, bulk actions can enable or disable selected repositories.

​
Repository detail view

Open a repository to review its tabs: The Tags tab refers to VCS tags such as Git tags. It is separate from product metadata tags. Branch and tag vulnerability counts show active vulnerabilities by severity. When Cysmiq carries forward an active location from an earlier scan, the ref table can also show a separate inferred count.

​
Branch scan actions

If your role can start scans, open the row action menu on the Branches tab to:
  • Select Scan branch when the current branch head has not been scanned
  • Select Rescan to retry an eligible failed scan for the current branch head
Cysmiq only shows these actions when the repository and branch are eligible for another scan. You can also retry eligible failed scans from the Scans view.

​
Vulnerability scope

The repository overview includes a Vulnerability scope selector. Use Default branches for normal security posture review. Use All branches when you need to investigate findings across every scanned ref.

​
Repository settings

The Settings tab can include:
  • Enable: controls whether Cysmiq scans the repository
  • Default Assignee: assigns a default user for new findings
  • Scan jobs: controls which analysis jobs run for the repository
  • Default branch filtering
  • VCS status behavior
  • Ticketing behavior
When a repository is disabled, the repository header shows that data is not up to date and points users to the Settings tab to re-enable scanning. Re-enabling an active repository queues reinitialization from its latest default-branch head. Archived repositories stay disabled, and Cysmiq waits for a confirmed active archive status before allowing re-enablement.

​
Scan jobs

Availability depends on your Cysmiq plan.
Use Scan jobs in the repository Settings tab to control which analysis families run:
  • SCA: manifest discovery, SBOM generation, and package advisory analysis
  • Provider checks: scan for secrets that can be checked with their provider
  • Context assessments: assess source context when a provider check is unavailable
  • Secret History: secret scanning across Git history when available
  • Code analysis: code scanning and post-processing
  • Call chains: local function and call-chain analysis
Available jobs are enabled by default. Call chains requires Code analysis. Choose All branches to run call-chain analysis on every branch, or Specific branches to provide comma-separated branch names or patterns such as main or release/*. Use Reset overrides to return the repository to its inherited scan-job settings. When a repository is marked as a monorepo, Cysmiq automatically disables Code analysis, Call chains, and Secret History for that repository.

​
SBOM export

Use Download SBOM on the repository detail page to export a CycloneDX SBOM for the repository. Available formats:
  • CycloneDX JSON
  • CycloneDX XML
Small SBOM exports download immediately. Larger exports are queued, and Cysmiq notifies you when the file is ready.