Git (generic Git URL)
Connect any Git repository to Safeguard by its HTTPS URL. Which credentials work for each Git host, what they need to read, and step-by-step setup.
What it does
The Git card connects Safeguard to any Git repository it can reach over HTTPS, whatever hosts it: a self-hosted server, a service without its own card, or one of the big hosts when you only want a few repositories. You add each repository by URL; Safeguard checks it with git ls-remote, and each repository you select (at a branch or tag) becomes a project that Safeguard clones and scans for an SBOM and findings. Find the card under Integrations on the Project/Product tab.
The Git card only reads. It cannot open fix pull requests, list repositories, or set statuses: use the GitHub, GitLab, Bitbucket, Azure DevOps or Oracle Cloud DevOps card for those.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | One or more public HTTPS repository URLs | A Username, an Access Token, and each repository URL |
| Credential needed | None | A token (or password) your Git host accepts for Git over HTTPS |
| What you can scan | The public repositories you add | The repositories you add that the credential can read |
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Username and access token over HTTPS | Private repositories | The token is sent as the Git password. Use a read-only token where your host offers one |
| Username and password over HTTPS | Your own server accepts passwords for Git over HTTPS | Prefer a token: it can be read-only and revoked on its own |
| None (Public tab) | Public repositories | Nothing to create |
| SSH key | Not available | Safeguard holds no SSH key for you, so git@... and ssh:// URLs cannot be cloned. Use the repository's HTTPS URL |
Hosts that check the username
The Verify & Add check uses the username you enter. Scans currently clone with the token and a fixed username instead. Hosts that ignore the username (GitHub, GitLab personal, project and group tokens, Azure DevOps) work. Hosts that check it, such as Bitbucket Cloud, GitLab deploy tokens, Oracle Cloud DevOps and many self-hosted servers, can pass the check and then fail the scan with git clone failed. For those, use the provider's own card where there is one.
Permissions required
Safeguard only reads: it runs git ls-remote to check the URL and list branches and tags, and a shallow git clone to scan. The credential needs read (clone) access to each repository and nothing else.
Username and access token, by host
| Host | Credential and permission | Required? | Username |
|---|---|---|---|
| GitHub | Fine-grained token with Contents: Read-only (Metadata is added automatically), or a classic token with repo | Required (one of them) | Your GitHub username |
| GitLab | Personal, project or group access token with read_repository, and at least the Reporter role | Required | Any non-blank value |
| Azure DevOps | Personal access token with Code (Read), for that organization | Required | Any value |
| Bitbucket Cloud | Atlassian API token with read:repository:bitbucket | Required | Your Bitbucket username, or x-bitbucket-api-token-auth (see the note above) |
| Oracle Cloud DevOps | Auth token, with read devops-family (or use devops-repository) | Required | <tenancy name>/<user> (see the note above) |
| Self-hosted Gitea, Forgejo, Gogs or other servers | A token or password with read access to the repository | Required | As your server requires (see the note above) |
| Any host | Write, admin or API scopes | Not needed |
Least privilege: a read-only token limited to the repositories you add.
Token types
| Token type | Works? | Notes |
|---|---|---|
| Read-only personal access token | Yes (recommended) | GitHub fine-grained, GitLab read_repository, Azure DevOps Code (Read), Bitbucket read:repository:bitbucket |
| Project, group or repository-scoped token | Yes, where the host ignores the username | GitLab project and group access tokens work; for others see the note above |
| GitLab deploy token | Check passes, scans may fail | It needs its own username, which scans do not send yet |
| Bitbucket app password | No | Bitbucket removed app passwords on July 28, 2026 |
| Account password | Only if your server accepts passwords for Git over HTTPS | |
| SSH key | Not available |
Expiry: follow your host's rules and choose a short lifetime, such as 90 days. When the token expires, scans fail until you paste a new one in the connection.
What we never need: write, push, admin or API scopes. The Git card never pushes.
Step-by-step setup
Create the credential at your Git host
Create a read-only token at your host, with the permission from the table above:
- GitHub: Settings > Developer settings > Personal access tokens > Fine-grained tokens > Generate new token, with Contents: Read-only. See the GitHub page.
- GitLab: Settings > Access tokens > Add new token on the project or group, with the Reporter role and
read_repository. See the GitLab page. - Azure DevOps: User settings > Personal access tokens > + New Token, with Code (Read). See the Azure DevOps page.
- Other servers: create a personal or application token with read access to repositories, as your server's documentation describes.
Copy the token when it is shown; most hosts show it only once.
Or with the git command line
Check the URL and credential exactly as Safeguard does before you add it:
# Prompts for the password: paste the token
git ls-remote https://<username>@git.example.com/team/repo.git
# A public repository needs no credential
git ls-remote https://git.example.com/team/public-repo.gitConnect it in Safeguard
- Open Integrations and choose the Project/Product tab.
- Click Connect on the Git card.
- For public repositories, stay on Public, enter a Name, paste each HTTPS URL under Enter a public Git URL and click Add. Then click Next.
- For private repositories, choose Private and enter a Name (and an optional Description).
- Under Git Credentials, enter the Username and paste the token into Access Token.
- Paste a repository URL under Enter a repository URL and click Verify & Add. "Repository accessible: credentials accepted" means Safeguard could list the repository's branches with your credentials. Add more URLs with Add.
- Click Next, choose the branch or tag of each repository, and finish with the Connect button (fast, deep or progressive scan).
The Git server must be reachable from the internet over a public address.
Webhooks and triggers
This integration has no webhooks. Each selected repository is scanned when you connect it. To rescan new commits, set a schedule under Integrations > Scheduled, or choose Rescan from the connection's menu under Project Configurations.
What we read and store
- Read: the branches and tags of each repository you add (
git ls-remote), and the repository's contents at the chosen branch or tag for each scan. - Stored: the connection's settings, the repository URLs and username, the SBOM and findings of each scan, and the token, which is encrypted at rest with a per-workspace key and never shown again after you save it.
- Not stored: source code. The scanner makes a shallow clone into a temporary folder and deletes it when the scan ends.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Enter your username and access token before adding a repository URL | Username or Access Token is empty | Fill in both, then click Verify & Add |
Could not access this repository with the provided credentials | The URL is wrong, the token is wrong or expired, the token cannot read this repository, or the server is not reachable | Run the git ls-remote check above with the same URL and token |
Invalid repository URL | A URL on the Public tab is not a public Git repository, is an SSH URL, or is a container registry address | Use the repository's public HTTPS URL, or the Private tab for a private repository |
Authentication failed. Verify your access token and username are correct. ... | Listing branches or tags was refused | Check the username and token, or paste a new token in the connection |
Repository not found. Verify the repository URL is correct and accessible. ... | The repository moved, was deleted, or the token lost access | Fix the URL or the token's access |
git clone failed: ... (on a scan) | The host refused the clone (see the note about hosts that check the username), or the branch or tag no longer exists | Use the provider's own card, or pick an existing branch or tag |
Rotation and disconnect
- Rotate: create a new token at your Git host. Under Project Configurations on the Project/Product tab, open the connection's menu, choose Update, paste the new token into Access Token, verify a repository URL, and click Save Changes. Then revoke the old token at your host.
- Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration. Then revoke the token at your Git host.
Vendor references
- git ls-remote, checked 2026-10-16.
- GitHub: managing your personal access tokens, checked 2026-10-16.
- GitLab: personal access tokens (Git over HTTPS), checked 2026-10-16.
- GitLab: deploy tokens, checked 2026-10-16.
- Azure DevOps: use personal access tokens, checked 2026-10-16.
- Bitbucket Cloud: using API tokens, checked 2026-10-16.
- Oracle Cloud DevOps: HTTPS authentication, checked 2026-10-16.
Perforce (Helix Core)
Connect Perforce Helix Core depots and streams to Safeguard. The protections each step needs, password or ticket sign-in, ssl: fingerprint pinning, step-by-step setup, change-commit triggers and polling.
Amazon ECR
Connect Amazon Elastic Container Registry (ECR) to Safeguard. The IAM permissions the access key needs, which credentials work, and step-by-step setup.