Phylum
Connect Phylum to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Phylum connection as vulnerability scanning evidence. Automated collection is not available for this provider yet.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Phylum:
- In the Phylum web UI, click the user menu in the top right and select API Access Tokens.
- Provide a name for the new key (for example Safeguard).
- Copy the newly generated API key (it starts with ph0_). There is no way to retrieve the value after initial generation.
Where to find the other values:
- Base URL (optional): Phylum's documented API host is https://api.phylum.io (for example /api/v0/groups).
- Account / Org / Workspace (optional): The Phylum group name, listed by GET https://api.phylum.io/api/v0/groups.
Phylum shows the secret only once, so copy it before you leave the page.
Phylum is now part of Veracode and its docs say they cover a legacy platform; customers are told to contact support@veracode.com to migrate. The key authenticates as the user who created it; no read-only scope is documented. CLI alternative: phylum auth login, then phylum auth token.
Source: docs.phylum.io, checked 2026-10-07.
-
On Compliance › Connectors, open Phylum, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Phylum publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC7.1 | 1 |
| ISO/IEC 27001 | Attestation | A.8.8 | 1 |
| HIPAA Security Rule | Attestation | 164.308(a)(1) | 1 |
| PCI DSS | Attestation | 6.3.3, 11.3.1 | 1 |
| NIST CSF 2.0 | Attestation | ID.RA-01 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks