Subversion (SVN)

What it does

The Subversion card connects Safeguard to one or more Subversion repositories on your server. For each repository you choose the path to scan (trunk, a branch, a tag or a custom path); Safeguard exports that path at its newest revision, scans it for an SBOM and findings, and records the revision number as the scan's commit. New commits are picked up by polling (the default) or by a post-commit hook you install. Find the card under Integrations on the Project/Product tab.

Subversion has no pull requests, so fixes arrive as a patch you download and apply with svn patch. If you give the connection write access and choose it, Safeguard can also commit a fix to a new branch under a path you name. It never commits to trunk.

Public vs private

Supported auth methods

A server with a self-signed or private-CA certificate works only after you confirm its fingerprint. Safeguard shows the fingerprint the server presented; compare it with the one your administrator gives you and tick the box. Safeguard then trusts exactly that certificate and nothing else.

Permissions required

Safeguard only reads, unless you turn on branch delivery for fixes. Subversion has no token scopes: access is the server's path-based authorization (the authz file that svnserve.conf names in authz-db, or Apache's AuthzSVNAccessFile). Give the account the smallest access that works.

User name and password (https:// or svn://)

Least privilege: r on the paths you scan and nothing else. Leave fixes as patch downloads.

SSH key (svn+ssh://)

Least privilege: a dedicated SSH key whose authorized_keys entry forces svnserve -t -r <repositories root>, with r access in authz.

Token types

Expiry: Subversion passwords and keys do not expire on their own. Rotate them on your normal schedule; when the server refuses the old one, scans fail with the authentication error below until you save the new one.

What we never need: write access to trunk or the paths you scan, svnadmin or hook-script access, server configuration, or any repository you do not add.

Step-by-step setup

Create the account on your server

1. For svnserve, add a line to the repository's conf/passwd file, for example safeguard = <a long random password>. For Apache, add the user to the file named by AuthUserFile, for example htpasswd /etc/apache2/svn.htpasswd safeguard.

2. In the authz file, give the account read access to the paths you scan:

   [app:/trunk]
   safeguard = r
   [app:/branches]
   safeguard = r

3. For SSH, create a key pair (ssh-keygen -t ed25519 -N "" -f safeguard), add the public key to the server account's authorized_keys, and get the host key line with ssh-keyscan -t ed25519 <server>.

4. If your server's certificate is self-signed, get its SHA-256 fingerprint so you can compare it in the dialog, for example openssl s_client -connect <server>:443 </dev/null | openssl x509 -noout -fingerprint -sha256.

Or with the Subversion command line

Check the access before you connect, from any machine:

svn info --username safeguard https://svn.example.com/repos/app/trunk
svn list --username safeguard https://svn.example.com/repos/app/branches

Connect it in Safeguard

1. Open Integrations and choose the Project/Product tab.
2. Click Connect on the Subversion (SVN) card.
3. Choose Public or Private, enter a Name, and put one repository root URL per line in Repository URLs.
4. For Private, choose Sign in with: User name and password, or SSH key (svn+ssh://) with the SSH private key and Server host key.
5. Choose the Repository layout: Standard (trunk, branches, tags), or Custom paths for the main line, branches and tags.
6. Choose how often to Check for new commits, and how to Deliver fixes as (a patch, or a new branch with write access and a Fix branch path).
7. Click Check access. If the server's certificate is not trusted, compare the fingerprint shown, tick This is my server's certificate, and the check runs again.
8. Click Next, pick each repository's path, and connect with the scan depth you want.

Webhooks and triggers

• On connect: each repository you select is scanned once.
• Polling (default): Safeguard checks each scanned path's newest revision every 15 minutes (5 minutes to 24 hours, or off) and rescans when it changed.
• Post-commit hook: in the connection's edit dialog, Scan on commit > Set up commit hook gives you a post-commit script and a credential file, safeguard-hook.conf. Save the script as <repository>/hooks/post-commit (or call it from your existing hook) and make it executable; save the credential file next to it, readable only by the user svnserve or Apache runs as (chmod 600). The server needs curl. The hook sends the revision, its author, the changed folders and the repository UUID to https://api.safeguard.sh/scm/api/v1/integrations/vcs-hooks/<connection id>, authenticated with the credential, and Safeguard rescans the projects whose path the commit touched. The credential is shown once; Issue a new hook credential rotates it and Revoke stops deliveries. The hook never blocks or changes a commit.
• Schedules: you can also rescan on a schedule from Integrations > Scheduled.

What we read and store

• Read: the files under each scanned path at the scanned revision, and the revision's number, author and date. For a fix, the original content of the files it changes.
• Stored: the SBOM, findings and project metadata; the revision number as the scan's commit; for fixes, the patch and the files it changes. The password or SSH key is encrypted at rest and never shown again after you save it. Non-secret settings (layout, pinned fingerprint, polling, fix delivery) are stored with the connection.
• Not stored: the exported source tree, which is deleted when the scan ends, and any working copy or Subversion auth cache (each run uses a private configuration directory that is removed afterwards).
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: change the password (or replace the key) on the server, then open the connection's edit dialog, enter the new credential, click Check access and save. To rotate the hook credential, click Issue a new hook credential and replace safeguard-hook.conf on the server.
• Disconnect: delete the connection under Integrations. Then remove the account or its authz lines on the server, delete its SSH key from authorized_keys, and remove the Safeguard post-commit hook and safeguard-hook.conf.

Vendor references

• Version Control with Subversion: Path-Based Authorization, checked 2026-10-16.
• Version Control with Subversion: svnserve, a custom server, checked 2026-10-16.
• Version Control with Subversion: httpd, the Apache HTTP Server, checked 2026-10-16.
• Version Control with Subversion: Implementing Repository Hooks, checked 2026-10-16.