Skip to main content

​
Overview

Use Repositories to review the primary scanned assets in Cysmiq. Repository views connect VCS metadata, scan activity, vulnerabilities, branch and tag refs, manifests, packages, and repository-level settings. Repositories are synced from your VCS integrations. Scans run against repository assets.

​
When to use repositories

  • Find scan status and the most recent scan for a repository
  • Review active vulnerabilities for a repository
  • Compare default branch scope with all branch scope
  • Inspect branch and tag refs
  • Export a repository SBOM
  • Configure repository-level scanning and ownership settings

​
Repository list

The Repositories list shows repository name, organization, type, scan status, active vulnerability counts, open technical impacts, last scan, and row actions. Use the list to filter by:
  • Repository name
  • Availability: Available by default, Orphaned, or All
  • Scan status
  • Repository type, including private, public, and monorepo repositories
  • Organization
  • Package, package version, manifest, or usage drilldowns opened from package and manifest views
The default Available filter hides repositories that are no longer present in the connected VCS provider. Select Orphaned or All when you need to find those repositories. Select one or more rows to export repositories. If available to your role, bulk actions can enable or disable selected repositories.

​
Repository detail view

Open a repository to review its tabs: The Tags tab refers to VCS tags such as Git tags. It is separate from product metadata tags. Branch and tag vulnerability counts show active vulnerabilities by severity. When Cysmiq carries forward an active location from an earlier scan, the ref table can also show a separate inferred count.

​
Endpoint inventory

Availability depends on your Cysmiq plan.
The Endpoints tab lists HTTP routes discovered in repository scans. Review each route’s method, application root, technology or source, handler, reference, and linked code findings. Search by route, handler, or source path, or filter by reference, method, and reachability. The default scope follows the repository’s default branch filter; select All references to review other scanned refs. Reachable means Cysmiq linked an active code finding to a discovered endpoint through call-chain evidence. Investigate external access and exploitability separately.

​
Security grade

Availability depends on your Cysmiq plan.
In the new repository experience, Security grade summarizes current scan evidence and findings requiring action on the configured default branch. A means the evidence is current and no known findings require action. Lower grades indicate findings that need attention, with the highest severity determining the grade. U means Cysmiq lacks enough current evidence or a finding still needs review. Open the repository overview for the reason and links to relevant findings.

​
Branch scan actions

If your role can start scans, open the row action menu on the Branches tab to:
  • Select Scan branch to scan the current branch head, including a head that has already been scanned
  • Select Rescan to retry an eligible failed scan for the current branch head
Cysmiq confirms the current branch head with your connected provider before queuing the scan. It reuses an eligible active scan for that head. A new scan waits if an earlier scan on the same branch is still running. Cysmiq only shows these actions when the repository and branch are eligible for another scan. You can also retry eligible failed scans from the Scans view.

​
Vulnerability scope

The repository overview includes a Vulnerability scope selector. Use Default branches for normal security posture review. Use All branches when you need to investigate findings across every scanned ref. With Default branches, the vulnerability trend reflects locations on the included refs. A finding counts as fixed in that scope once all its locations on those refs are fixed, even if it remains open on another branch. With All branches, the trend follows the finding’s overall lifecycle status.

​
Repository settings

The Settings tab can include:
  • Enable: controls whether Cysmiq scans the repository
  • Default Assignee: assigns a default user for new findings
  • Scan jobs: controls which analysis jobs run for the repository
  • Default branch filtering
  • VCS status behavior
  • Ticketing behavior
When a repository is disabled, the repository header shows that data is not up to date and points users to the Settings tab to re-enable scanning. Re-enabling an active repository queues reinitialization from its latest default-branch head. Archived repositories stay disabled, and Cysmiq waits for a confirmed active archive status before allowing re-enablement.

​
Scan jobs

Availability depends on your Cysmiq plan.
Use Scan jobs in the repository Settings tab to control which analysis families run:
  • SCA: manifest discovery, SBOM generation, and package advisory analysis
  • Provider checks: scan for secrets that can be checked with their provider
  • Context assessments: assess source context when a provider check is unavailable
  • Secret History: secret scanning across Git history when available
  • Code analysis: code scanning and post-processing
  • Call chains: local function and call-chain analysis
Available jobs are enabled by default. Call chains requires Code analysis. Choose All branches to run call-chain analysis on every branch, or Specific branches to provide comma-separated branch names or patterns such as main or release/*. Use Reset overrides to return the repository to its inherited scan-job settings. When a repository is marked as a monorepo, Cysmiq automatically disables Code analysis, Call chains, and Secret History for that repository.

​
SBOM export

Use Download SBOM on the repository detail page to export a CycloneDX SBOM for the repository. Available formats:
  • CycloneDX JSON
  • CycloneDX XML
Small SBOM exports download immediately. Larger exports are queued, and Cysmiq notifies you when the file is ready.