--- description: "Efficiently manage Git repositories, IP Roots, and URL Roots for comprehensive security testing with Fluid Attacks. Add, edit, and exclude repos to tailor your scope." keywords: "add new repository, Git repositories, URL roots, CSV file, IP Roots, production environment, repository registration, Health Check, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: Manage repositories --- # Manage repositories import { Image } from "@/components/image"; import { Table } from "nextra/components"; In Fluid Attacks' platform, repositories are the top-level entry points for security testing. If your group's subscription includes [white-box testing](https://help.fluidattacks.com/portal/en/kb/articles/glossary#White_box), you can add [Git repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository) and [environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments) to the [scope](https://help.fluidattacks.com/portal/en/kb/articles/scope). If it includes [black-box testing](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Black_box), you can add [IP roots](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Add_an_IP_root) and [URL roots](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Add_a_URL_root). ## Manage Git repositories The [list and details](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Know_your_Git_repositories_table) of Git repositories that are cloned and subsequently analyzed for vulnerabilities is in the **Scope** section under the title **Git Repositories**. Within this section, you can [add new repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository) and perform various actions in relation to listed repos, including [editing](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Edit_a_Git_repository), [enabling or disabling](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Deactivate_a_Git_repository) them, [exporting repository data](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Export_Git_repositories_table), and [excluding subpaths](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Exclude_subpaths_in_Git_repositories) from security testing. ## Branch testing coverage 1. Fluid Attacks' [plans](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing) include automated testing of as many branches as needed [through its scanner's CLI](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities/use-the-cli), allowing testing [before](https://help.fluidattacks.com/portal/en/kb/articles/run-scans-locally), [during](https://help.fluidattacks.com/portal/en/kb/articles/use-the-scanners-in-ci-cd) and [after](https://help.fluidattacks.com/portal/en/kb/articles/use-standalone-scanners) the integration of code to a main branch also under testing. 1. Fluid Attacks' team of pentesters in the Advanced plan tests **manually** only one active repository branch per group looking for vulnerabilities in one single version of the system. Testing only one branch allows for better security, as only this way it is guaranteed that contributing developers do not bypass tests and that the system version tested is the one integrated and to be deployed. Moreover, this allows coherent assessments and makes it easier to keep track of findings and fixes. As a result, your development team can efficiently [address reported vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments), while Fluid Attacks' team can effectively [verify](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks) the successful implementation of your fixes. In conjunction with code branch analysis, Fluid Attacks also manually tests the equivalent [environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments) associated with the provided code branch, ensuring comprehensive security coverage. ## About repository cloning When adding a Git repository successfully to the platform, it is cloned (i.e., `git clone`'d) to be subjected to security tests. You can read Fluid Attacks' [confidentiality compliance measures](https://help.fluidattacks.com/portal/en/kb/compliance/confidentiality) to learn how your repository clone is secured. On all active repositories, a scheduled cloning process is performed to ensure the platform always has the up-to-date versions of your repositories (this happens every three hours on working hours, Monday through Friday). You can also trigger a clone process (in case you add new changes you want to analyze) by using the **Update** button in the **Scope** section (see below). Further, when you request a [reattack](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks) in **Vulnerabilities**, cloning of your repository is performed to ensure analyses on its up-to-date version. If you [deactivate a Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Deactivate_a_Git_repository) in the platform, this deletes the clone Fluid Attacks has and stops testing on that repository. ## Know your Git repositories table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The table in **Git Repositories** shows your repositories included in the scope of security testing as well as those previously included (these are marked as 'Inactive'). View Git repositories under testing on the Fluid Attacks platform

View Git repositories under testing on the Fluid Attacks platform

Here is a description of the columns of this table: - **URL:** The URL of the repository containing the code that is cloned and tested - **Branch:** The specific branch that is tested (Fluid Attacks assesses [only one active repository branch](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Branch_testing_coverage) per group) - **Tests:** Whether the repository is in the scope of security testing, where **Active** means it is undergoing testing, and **Inactive** means it is not being tested - **Status:** The [code repository cloning](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#About_repository_cloning) status, which can be one of the following: - **Cloning:** Repository is being cloned - **Cloned:** Repository successfully cloned - **Failed:** Cloning encountered an error - **Inactive:** Repository not cloned, as it is not in the current scope - **Unknown:** Initial status before cloning - **Queued:** A tool run to check this repo is queued > [!NOTE] > > When an [event](https://help.fluidattacks.com/portal/en/kb/articles/resolve-events-impeding-tests) is present regarding a repository, the tag 'Open event' is displayed in this column along with an icon that links to the reported problem on the platform. - **Nickname:** A name derived from the URL for easy identification of the repository - **Sync:** Initiates a request to reclone the repository when changes have been made and, therefore, an updated version is required (while not having requested syncing, repositories are recloned [every three hours on working days](https://help.fluidattacks.com/portal/en/kb/articles/repositories-synchronization)) - **Health Check:** Whether [Health Check](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Health_Check) is included for the repository (only groups in the **Advanced** plan have this field enabled, as Health Check involves [manual security testing](https://fluidattacks.com/solutions/penetration-testing-as-a-service/)); these values are possible: - **Included:** Health Check is included - **Not Included:** Health Check is not included - **Requested:** Health Check has been requested A downward-facing arrow is present to the left of the **URL** column. Clicking this arrow expands the row to reveal a description for each repository. You can also use the arrows in rows to expand them individually. Reveal details of the Git repository on the Fluid Attacks platform

Reveal details of the Git repository on the Fluid Attacks platform

> [!TIP] > > **Note:** The nickname is automatically derived from the URL associated with the added repository. Duplicate nicknames are not permitted. If a new repository is being added, and its nickname would be one that already exists, four random characters are appended to the URL-associated nickname. ## Add a new Git repository > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager Click the **Add new** button to include a code repository to the security testing scope. You can add a new repository using [Open Authorization](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_Git_repositories_using_OAuth) (OAuth) or [manually](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository_manually) inputting the repository details. Add a new Git repository on the Fluid Attacks platform

Add a new Git repository on the Fluid Attacks platform

### **Add Git repositories using OAuth** OAuth enables a streamlined method for adding repositories from popular providers: Azure, Bitbucket, GitHub, and GitLab. Before adding a Git repository in Scope with this method, you must first [authorize the connection](https://help.fluidattacks.com/portal/en/kb/articles/import-repositories-fast-and-safely-with-oauth#Enable_OAuth) between the Fluid Attacks platform and the account on the supported provider. Once you have created the OAuth credentials on the platform, follow these steps to add a Git repository in the **Scope** section: 1. Click on **Add new** and select the code repository hosting provider where you have your repository. For this example, GitLab is used as the provider. Add new GitLab repository on the Fluid Attacks platform

Add new GitLab repository on the Fluid Attacks platform

1. Upon clicking the provider, a pop-up window prompts you to choose the user credentials corresponding to the OAuth connection for that provider. Select the Git repository credentials on the Fluid Attacks platform

Select the Git repository credentials on the Fluid Attacks platform

1. After selecting the credentials, the platform retrieves all relevant data from the associated repositories and their branches. Please note that the loading time may vary depending on the volume of data. Once the data is loaded, the **Continue** button becomes active. Click it to proceed. 1. You are presented with a three-step form. First, choose the repository or repositories you wish to add and click on **Next step**. Select repos to add via OAuth on the Fluid Attacks platform

Select repos to add via OAuth on the Fluid Attacks platform

1. Select a specific branch of each repository to test. Confirm your choice by clicking **Next step**. Choose branch to test on the Fluid Attacks platform

Choose branch to test on the Fluid Attacks platform

1. Specify whether you wish to [exclude files](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Exclude_subpaths_in_Git_repositories) from security testing. If you choose **Yes**, you are asked to provide the paths of specific files or folders to exclude. (You may also exclude files elsewhere, using [exclusions as code](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Set_exclusions_as_code).) Exclude files from repos on the Fluid Attacks platform

Exclude files from repos on the Fluid Attacks platform

Then, specify whether you wish [Health Check](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Health_Check) be performed. That is, whether you wish for code already in the repository to be subjected to manual testing by the team of pentesters. If you choose **Yes**, you are asked to accept the additional cost it entails. Request Health Check on the Fluid Attacks platform

Request Health Check on the Fluid Attacks platform

If you choose **No**, you are asked to acknowledge the risks. Decline Health Check on the Fluid Attacks platform

1. Click the **Add repository** button to add the Git repository or repositories. Add Git repository on the Fluid Attacks platform

### **Add a new Git repository manually** To add a new Git repository manually inputting the repository details, follow these steps: 1. Click on **Add new** and choose **A\*\***dd manually\*\*. Add Git repository manually on the Fluid Attacks platform

Add Git repository manually on the Fluid Attacks platform

1. You are presented with a form where you need to provide the following information for the repository: - **Repository URL:** The URL where the repository is located - **Repository branch:** The specific branch within the repository to be tested - **[Connector](https://help.fluidattacks.com/portal/en/kb/articles/connector):** Whether the repository is behind a private network and Cloudflare Tunnel is configured - **[Egress](https://help.fluidattacks.com/portal/en/kb/articles/egress):** Whether the repository is behind a private network and specific IPs need to be whitelisted on your firewall - **[Existing credentials](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Existing_credentials):** If applicable, choose the previously created credentials to access the repository - **[Credential type](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Credential_type):** The authentication method to be used, identified automatically from the URL: - **User and password:** The traditional login method using your username and password combination - **SSH:** A secure key-based authentication method for accessing remote systems, offering enhanced security compared to passwords - **Access token:** A Personal Access Token for authorizing Fluid Attacks with Azure DevOps. - **AWSROLE:** Allows Fluid Attacks to assume an Identity and Access Management (IAM) role in your AWS account - **OAUTH:** Allows Fluid Attacks to access your repositories on supported platforms (Azure, Bitbucket, GitHub, and GitLab) - **Name your credentials:** A name to easily identify the credentials - **[Exclusions](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Exclude_subpaths_in_Git_repositories):** Whether some files or folders should be excluded from security testing, and, if so, their paths (exclusions can also be indicated [with code](https://help.fluidattacks.com/portal/en/kb/articles/exclude-findings-from-scan-reports); this field is only available for Group Managers) - **Health Check:** Whether you wish [Health Check](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Health_Check) to be performed (i.e., having Fluid Attacks' pentesters manually test existing code) Fill out Git repository form on the Fluid Attacks platform

Fill out Git repository form on the Fluid Attacks platform

Please note that you need to provide the URL and branch that have not yet been registered in your organization. Otherwise, you are prevented from registering them again. Register URL and branch only once on the Fluid Attacks platform

Register URL and branch only once on the Fluid Attacks platform

1. Click on **Confirm** to add the repository. ## Existing credentials Fluid Attacks needs credentials to access the repositories to test. During the process of [adding](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository) or [editing](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Edit_a_Git_repository) a repository, you encounter the field **Select an existing repository credential**. Clicking on the dropdown menu reveals a list of credentials that have been either used for adding Git repos in the past or previously added on their own in the [**Credentials** section](https://help.fluidattacks.com/portal/en/kb/articles/manage-your-credentials#Add_credentials). In any case, they are stored for use across the groups within the organization. Use existing credentials on the Fluid Attacks platfom

Use existing credentials on the Fluid Attacks platfom

If any of the listed credentials are suitable for the repository you are adding or editing, select it. This automatically fills out the **Credential type** and **Name your credential** fields. Choose existing credentials on the Fluid Attacks platform

Choose existing credentials on the Fluid Attacks platform

## Credential type To add a Git repository within the **Scope** section, you can provide any of the following authentication methods: user and password, SSH key, Azure Personal Access Token, and cross-account AWS IAM role. The platform identifies the credentials type based on the repository URL you provide. ### Add a repository with user and password HTTPS authentication allows you to access the repository by supplying a username and password pair. When you fill out all the fields related to credentials, a button saying **Check access** appears. Clicking it tells the platform to validate the correctness of the provided access credentials for successful repository cloning. It is advisable to check access and proceed with adding the repository only if the message "Success - Access checked!" appears. Use HTTPS authentication on the Fluid Attacks platform

Use HTTPS authentication on the Fluid Attacks platform

> [!TIP] > > **Note:** When providing the username and password for a GitHub repository, you must replace the password with a personal token. Refer to the [official GitHub documentation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) for guidance on generating this token. ### Add a repository with an SSH key SSH keys establish a connection to your repository server without the need for a username and password. When you choose this credential type when [adding](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository) or [editing](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Edit_a_Git_repository) a Git repository, you are required to provide a private key. Use SSH key as credentials on the Fluid Attacks platform

Use SSH key as credentials on the Fluid Attacks platform

> [!TIP] > > **Note:** For instructions on how to set up SSH keys, refer to your code repository hosting provider's official documentation. See, for instance, [GitHub's](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account) and [GitLab's](https://docs.gitlab.com/ee/user/ssh.html#add-an-ssh-key-to-your-gitlab-account) pages. ### Add a repository with an Azure DevOps PAT To securely connect Fluid Attacks to your Azure DevOps repositories, you need to use a Personal Access Token (PAT). This acts as a unique password, granting specific access rights without sharing your primary account credentials. After generating a PAT with the necessary permissions within Azure DevOps, you can enter it here to enable Fluid Attacks to clone and evaluate your repository. Use Personal Access Token on the Fluid Attacks platform

Use Personal Access Token on the Fluid Attacks platform

> [!TIP] > > **Note:** For information on managing your Personal Access Tokens, read the [official Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows). ### Add a repository with a cross-account IAM role To seamlessly integrate Fluid Attacks with your AWS environment across multiple accounts, you can leverage a cross-account Identity and Access Management ( IAM) role. This allows you to establish a role in one AWS account that securely delegates specific permissions to another AWS account, enabling Fluid Attacks to access and assess your resources without requiring direct credentials. Fluid Attacks has published the instructions to create an IAM role in [Set up an AWS integration](https://help.fluidattacks.com/portal/en/kb/articles/set-up-an-aws-integration#Create_an_IAM_role). Use AWS IAM role on the Fluid Attacks platform

Use AWS IAM role on the Fluid Attacks platform

> [!TIP] > > **Note:** For information on cross-account resource access, read the [official AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html). ## Exclude subpaths in Git repositories > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager You may decide to exclude specific files or entire folders from the scope of Fluid Attacks' security testing. This could be due to various reasons, such as excluding functional tests or dummy files within your repository. Fluid Attacks' platform provides a mechanism to achieve this. However, it is crucial to note that you may have vulnerabilities in the excluded files or folders excluded and may never find out. > [!TIP] > > **Note:** There is no restriction on the number of exclusions you can define. Tailor the exclusions to your specific requirements. To make exclusions, follow these steps: 1. Access the **Scope** section of your group. 1. If your intention is to [add a Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository) and define the files or entire folders to exclude, click on **Add new**. But if you wish to define exclusions from a previously added repository, click on its URL. Click on Git repository URL on the Fluid Attacks platform

Click on Git repository URL on the Fluid Attacks platform

1. In the pop-up window, scroll down to **Exclusions**. Locate exclusions on the Fluid Attacks platform

1. Switch the answer to **Yes**. A field then appears where you can enter the pattern for the file or folder you wish to exclude. You can keep adding exclusions using the **Add another** option, or delete them clicking on the corresponding trash can icon. Exclude subpaths from testing on the Fluid Attacks platform

Exclude subpaths from testing on the Fluid Attacks platform

> [!TIP] > > It is advisable to know about [pattern usage and exclusion best practices](https://mirrors.edge.kernel.org/pub/software/scm/git/docs/gitignore.html#_pattern_format) beforehand. Click the question mark icon next to "Specify the folders, files or paths to be excluded" to access reference documentation. > [!CAUTION] > > Please note that Fluid Attacks' exclusion option does not support patterns with the prefix '!' explained in the above [link](https://mirrors.edge.kernel.org/pub/software/scm/git/docs/gitignore.html#_pattern_format). > [!CAUTION] > > Use the wildcard (\*) carefully and always try to be as specific as possible. 1. Click on **Confirm** to apply the exclusions. Confirm subpath exclusion on the Fluid Attacks platform

Confirm subpath exclusion on the Fluid Attacks platform

> [!TIP] > > **Note:** If you exclude files or folders with unmanaged vulnerabilities, please be aware that the [Status](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_where_vulnerabilities_are_located) of those findings does not appear as 'Closed' immediately. You must wait for the next scheduled tool run or request a manual [reattack](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks) in which Fluid Attacks' tool or pentesters update the Status. ### Exclusion examples - \***\*`node_modules/`\*\*** - \***\*`build/tmp/`\*\*** - \***_`test/_.js`\*\*** (exercise caution when using wildcards) - \***\*`repo-root/dummy/excludeme.js`\*\*** > [!TIP] > > **Note:** Keep in mind that exclusion is a case-sensitive feature, which means it distinguishes between uppercase and lowercase letters in the path you provide. ### Set exclusions as code Fluid Attacks' scanner recognizes exclusions specified directly within your application's source code. One way is adding `NOFLUID` and an explanation as comment before insecure code. Another way is having exclusions specified in a `.fluidattacks.yaml` file at the root of the project. Read the details in [Exclude findings from scan reports](https://help.fluidattacks.com/portal/en/kb/articles/exclude-findings-from-scan-reports). ## Import repositories through a CSV file > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager ### Prepare the CSV file You can import multiple repositories for testing via a comma-separated values (CSV) file. This method allows adding up to 1,000 repos. Ensure your CSV file adheres to the following header format with eight columns. Create CSV file to import repositories to the Fluid Attacks platform

Create CSV file to import repositories to the Fluid Attacks platform

> [!TIP] > > You can download a sample of this CSV format from the Fluid Attacks platform. In the desired group, go to **Scope**, click on **Import** and then on **example CSV import file**. You may also download the file on this page. To find this option, just scroll all the way down to **Attachments**. The following table explains the information to include in the file: **Column name** **Mandatory in file** **Description** **Example** ****`url`**** Yes The URL of the repository containing the code to be cloned (include the protocol prefix, i.e., https:// or ssh://) ****`ssh://[git@gitlab.com](mailto:git@gitlab.com):user/example-repo.git`**** ****`branch`**** Yes The specific branch to be cloned ([only one repository branch](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_Git_repositories) is assessed per group) ****`main`**** ****`includes_health_check`**** Yes Indicates whether Health Check is requested for the repository (can be ****`true`**** or ****`false`****) ****`true`**** ****`git_ignore`**** Yes (can be left empty) The paths within the repository that you want to exclude from testing. If excluding multiple paths, separate them using semicolons (;). For comprehensive evaluations, **you are advised to leave this field empty**. ****`test_data/ ;mocks/files/`**** ****`credential_id`**** Yes The unique identifier for the credentials used to access the repository, which you can obtain by querying the [Fluid Attacks API](https://app.fluidattacks.com/api), as shown below this table, after registering your credentials. ****`4f48f4d2-8478-4a33-a2d3-fac8e03d9cfc`**** ****`connection`**** No The type of connection to your assets. You can set it to `egress` or `ztna` or leave it blank for no custom connection; get more information in [Access to your assets](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities/access-to-your-assets). ****`ztna`**** ****`nickname`**** No (defaults to the repository name if left blank) The custom nickname for your repo. You can define it using alphanumeric and some special characters (`:_.`) but not exceeding 128 characters, or leave it blank. The nickname must be unique in your organization. ****`my_repo_1`****

Query the API as follows to get the credentials ID: ``` query MyQuery { organizationId(organizationName: "org_name") { credentials { id name ``` ``` type } } } ``` Below is an example where you can see the ID within the result. Query organization credentials on the Fluid Attacks API

Query organization credentials on the Fluid Attacks API

> [!NOTE] > > Make sure to match the selected credentials type with the URL protocol. For instance, if the URL employs SSH, opt for SSH credentials. ### Import the CSV file Once your CSV file is prepared, follow these steps to import the repositories on the Fluid Attacks platform: 1. Go to the **Scope** section and click on the **Import** button. Import repositories with a CSV file on the Fluid Attacks platform

Import repositories with a CSV file on the Fluid Attacks platform

1. Click on **Add file**. Upload CSV file on the Fluid Attacks platform

> [!TIP] > > Here you can also download the sample CSV file on which to base yours. This file is also available on this page under **Attachments**. 1. Select the CSV file and click on **Upload**. After clicking on Upload, you receive a confirmation message, and the added Git repositories are visible on the table and start being [cloned on the platform](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#About_repository_cloning). > [!TIP] > > **Note:** If an error occurs during import, it is likely due to your file not adhering to the required format. Carefully review the error message for specific details on the issue and its location within the file. See below the kinds of checks to which the CSV file is subjected. ### CSV file checks When you upload a CSV file to import multiple repositories, it goes through the following checks: - **Invalid URL or branch:** Ensures the provided URL and branch are valid and correctly formatted - **Prevention of CSV injection:** Safeguards against malicious code [injection attempts through the CSV file](https://owasp.org/www-community/attacks/CSV_Injection) - **Incorrect characters:** Verifies that fields do not contain invalid characters - **Credentials ID validation:** Confirms the validity of the specified credentials ID - **Avoiding duplicates:** Prevents duplicate entries within the CSV file (same URL and branch) - **Avoiding Root Duplicates:** Prevents the import of repositories that already exist on the platform ## Export Git repositories table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager Click the **Export** button to download a comma-separated values (CSV) file containing not only the information displayed in the [Git repositories table](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Know_your_Git_repositories_table), but also the following: Export CSV with Git repositories on the Fluid Attacks platform

Export CSV with Git repositories on the Fluid Attacks platform

- **Id:** Unique identifier of the repository - **State:** Indicates whether the repository is currently active - **Cloning message:** Additional information about the cloning process or its outcome - **Use egress:** Indicates if Cloudflare Egress IPs are required for cloning - **Use vpn:** Indicates if the Legacy VPN is required for cloning - **Use ztna:** Indicates if Cloudflare ZTNA is required for cloning - **Repo creation date:** Timestamp when the repository was added to the platform - **Added by (mail):** Email of the user who originally added the repository - **Last edited by (mail):** Email of the user who last modified the repository prior to export - **Date last edited:** Timestamp of the most recent modification before export - **Credentials Id:** Identifier(s) of the credentials used for cloning - **Credentials name:** Name assigned to those credentials - **Credentials type:** Credential method used (e.g., HTTPS, OAUTH, AWSROLE) - **Gitignore:** Repository paths excluded from assessments - **Environments:** URLs for accessing associated environments - **Excluded environments:** Environment URLs excluded from assessments ## Show or hide columns of the Git repositories table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The **Columns** button allows you to reorder, show or hide columns in the [Git repositories table](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Know_your_Git_repositories_table). Click it, then customize the table to your need, and click on **Save**. Show or hide Git repositories table columns on the Fluid Attacks platform

Show or hide Git repositories table columns on the Fluid Attacks platform

## Filter the Git repositories table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager You can filter the [Git repositories table](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Know_your_Git_repositories_table) using the options presented after clicking the filters button (

Filter the Git repositories table on the Fluid Attacks platform

Find filter options Apply filters to Git repositories on the Fluid Attacks platform

Choose filters to apply ## Edit a Git repository > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager > [!TIP] > > Members with the User role can update the following Git repository details: [Nickname](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_nickname), [Connector access, Egress access](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository_manually), [credentials](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Existing_credentials), and [Health Check](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Health_Check). You can modify the specifics of an active Git repository (i.e., any one that is inside the scope of evaluation) following these steps: 1. In the **Scope** section, locate the active Git repository you wish to edit and click on its URL. Click on Git repository URL to edit on the Fluid Attacks platform

Click on Git repository URL to edit on the Fluid Attacks platform

1. The pop-up window presents three tabs for navigation: **Git repository**, **[Environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments)**, and **[Docker images](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_Docker_images)**. Adjust the details as necessary in the **Git repository** tab. Edit Git repository on the Fluid Attacks platform

Edit Git repository on the Fluid Attacks platform

1. Click on **Confirm** to apply the changes. > [!CAUTION] > > When altering the repository's URL and branch, a warning message is displayed, highlighting the potential risks tied to such modifications. Proceed with these changes only after careful consideration. Edit URL or branch on the Fluid Attacks platform

Edit URL or branch on the Fluid Attacks platform

## Deactivate a Git repository > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager > [!CAUTION] > > Scope changes may lead to reporting new vulnerabilities or changing the [Status of reported vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_where_vulnerabilities_are_located) to 'Closed'. To keep a repository within the scope of security testing or leave it out, you may change its **Tests** value. The latter, shown in the Scope section, can be set to **Active** or **Inactive**: - **Active:** The repository is cloned and accessible for analysis by Fluid Attacks' AppSec testing tool and pentesters - **Inactive:** The repository was added to the scope by mistake, does not exist anymore, or its location was changed, therefore Fluid Attacks does not clone it nor test it You have the flexibility to modify the Tests configuration at any time. [A detailed change history is maintained for traceability](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#Can_I_remove_a_repository_from_the_platform). Moreover, Tests changes trigger [email notifications](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Repository_updates) to all project stakeholders subscribed to them, both within Fluid Attacks and the customer's organization. These are the steps to deactivate a repository: 1. Go to the [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group)'s **Scope** section to locate the repository you wish to deactivate. Locate repository to deactivate on the Fluid Attacks platform

Locate repository to deactivate on the Fluid Attacks platform

1. In the **Tests** column, switch the toggle to off. (If this column is not showing, try seeing whether it is hidden using the [Columns option](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Show_or_hide_columns_of_the_Git_repositories_table).) Deactivate a repository on the Fluid Attacks platform

Deactivate a repository on the Fluid Attacks platform

1. A pop-up window prompts you to specify the reason for deactivation. Explain repo deactivation on the Fluid Attacks platform

You can choose one of the following reasons: - **Registered by mistake\*\***:\*\* You or your team had mistakenly added this repo or made mistakes filling out its details (if you simply need to update the URL, branch, or other attributes of a Git repo, consider [editing](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Edit_a_Git_repository) instead of deactivating it). - **Moving to another group\*\***:\*\* You wish to transfer the repo, along with its associated vulnerability report, to a different group. After choosing this option, use the search bar to find the target group within your organization, which must be under the same subscription as the currently opened. - **Other:** If neither of the above reasons applies, use this option to provide your explanation for deactivation. 1. Click on **Confirm** to apply the deactivation. Remove repository added by mistake on the Fluid Attacks platform

Remove repository added by mistake on the Fluid Attacks platform

## Manage IP Roots An IP address serves as a unique identifier for a device connected to the Internet or a local network. If your [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group) is subscribed to [black-box testing](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Black_box), i.e., security testing without access to source code, you can manage IP roots in the Scope section. By providing Fluid Attacks with an IP address, you enable Continuous Hacking to evaluate the security posture of all web applications reachable through that specific target. ## Know your IP roots table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The table under **IP Roots** in the **Scope** section offers information of the IP addresses you have designated for Fluid Attacks' analysis. View IP addresses on evaluation in the Fluid Attacks platform

View IP addresses on evaluation in the Fluid Attacks platform

These are the descriptions of each column: - **Address:** The specific IP address under evaluation - **Nickname:** A user-defined name for easy identification of the IP root - **State:** Whether the root is in the scope of security testing, where **Active** means it is undergoing testing, and **Inactive** means it is not being tested ## Add an IP root > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager To add a new IP root, follow these steps: 1. Go to the **Scope** section of the group where you wish to add an IP address to test. 1. Click on **Add new root** under **IP Roots**. 1. Provide the address and define its nickname. Add IP root to test on the Fluid Attacks platform

Add IP root to test on the Fluid Attacks platform

1. Click on Confirm. ## Edit an IP Root > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager You can modify the nickname of an existing IP root following these steps: 1. Go to your group's **Scope** section. 1. Click on the IP root you wish to edit. Select the IP root to edit on the Fluid Attacks platform

Select the IP root to edit on the Fluid Attacks platform

1. In the pop-up window, change the nickname as desired. Change IP root nickname on the Fluid Attacks platform

> [!TIP] > > **Note:** Each IP root must have a unique nickname. 1. Click Confirm. Confirm IP root edit on the Fluid Attacks platform

## Deactivate an IP Root > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager The steps and considerations for deactivating an IP root are the same as for [deactivating a Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Deactivate_a_Git_repository). ## Manage URL Roots URL roots represent dynamic environments already deployed on a web server. Adding them to Fluid Attacks' scope allows for direct assessment of your live web applications without access to source code. This is available to groups subscribed to [black-box testing](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Black_box). ## Know your URL Roots table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The **Scope** section has a table that shows the URL roots. View tested URLs on the Fluid Attacks platform

View tested URLs on the Fluid Attacks platform

The table shows the following information: - **Host:** The domain name or IP address of the web server - **Path:** The specific path within the URL to be assessed - **Port:** The port number used to access the URL - **Protocol:** The protocol used by the browser (e.g., HTTP or HTTPS) - **Query:** Any query parameters included in the URL - **Nickname:** A user-defined name for easy identification - **State:** Whether the root is in the scope of security testing, where **Active** means it is undergoing testing, and **Inactive** means it is not being tested ## Add a URL root > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager Here are the instructions to add a new URL root to subject it to security testing: 1. Go to the **Scope** section of the group where you wish to add the URL root. 1. Under **URL roots**, click on the **Add new root** button. 1. Provide the complete URL of the deployed environment you want to assess and a nickname for it. Add URL to test on the Fluid Attacks platform

Add URL to test on the Fluid Attacks platform

1. Click on **Confirm**. ## Edit a URL Root > [!NOTE] > > **Role required:** User or Group Manager By clicking on the URL of your interest, you can access the options to change its nickname, any secrets needed for access, and any [subpaths excluded from testing](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Exclude_subpaths_in_URL_Roots). To change the nickname of an existing URL root, follow these steps: 1. Go to your group's **Scope** section. 1. Click on the URL root you wish to edit. Select URL root to edit on the Fluid Attacks platform

Select URL root to edit on the Fluid Attacks platform

1. In the pop-up window, change the nickname as desired. Edit URL to test on the Fluid Attacks platform

> [!TIP] > > **Note:** Each URL root must have a unique nickname. 1. Click **Confirm**. ## Deactivate a URL Root > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager The steps and considerations for deactivating a URL root are the same as for [deactivating a Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Deactivate_a_Git_repository). ## Exclude subpaths in URL Roots > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager > [!CAUTION] > > Please note that excluding subpaths means they are not considered in vulnerability analysis. To exclude a subpath of an active URL root from security testing, proceed as follows: 1. Go to the group's **Scope** section. 1. Click on the host of the URL root containing the subpath you want to exclude. Select URL to exclude on the Fluid Attacks platform

Select URL to exclude on the Fluid Attacks platform

1. In the pop-up window, switch to the **Excluded sub paths** tab. View excluded URL paths on the Fluid Attacks platform

1. Click the **Add sub path** button. 1. Enter the subpath you wish to exclude. Exclude URL path from testing on the Fluid Attacks platform

1. Click **Confirm**. To reinclude the subpath to the testing scope, follow these steps: 1. Click on the host of the URL root. 1. Go to the **Excluded sub paths** tab. 1. Click on the trash can icon corresponding to the subpath you want to reinclude. Reinclude URL path for testing on the Fluid Attacks platform

Reinclude URL path for testing on the Fluid Attacks platform

> [!TIP] > > **Free trial** > Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).