Guides
Onboard a repository
Connect a code repository, prove ownership through your git provider, and scan it.
A repository asset is identified by its owner/name. Ownership is proven
through the git provider you authorise, not a DNS record.
Steps
- Open Repositories and choose Connect a repository.
- Authorise the git provider (GitHub, GitLab or Bitbucket). This connection is both how Kissaki reads the code and how it proves you own the repository.
- The asset flips to verified once the provider confirms access.
- Start a scan from the repository row, or let scheduled scanning pick it up.
What a repository scan produces
- SCA - vulnerable and outdated dependencies.
- Secrets - credentials committed to the tree.
- Licences - dependency licences classified against policy.
- SAST - code-level issues, correlated to the route map where possible.
Deterministic detections are delivered as-is; the detection is the proof. See findings and proof.
Next
- Gate pull requests on the scan verdict.
- Read and triage the findings.