Cefense reads your code through your provider, using a credential you grant and can withdraw. There is nothing to install into your infrastructure and no key for you to paste anywhere.
How connections work
A connection has two levels. First you connect the account, which is what lets Cefense see a list of repositories at all. Then you connect individual repositories from that list, and only those are ever scanned.
Connecting a repository queues its first scan straight away. Once connected, a repository behaves the same regardless of which provider it came from: the same scans, findings, branches, commits, and fixes.
How many you can connect
The plan sets it: 2 repositories on Free, 10 on Plus, unlimited on Pro and Max. The count is checked when you connect a new one, and a connection past the limit is refused with repository_limit rather than accepted and left half working.
The three providers
From the terminal
The CLI connects repositories from all three hosts. cf provider list says which accounts are connected, and cf repo connect --provider <host> lists that host's repositories and connects the ones you choose.
cf provider list
cf repo connect --provider gitlab
cf repo connect acme/api
cf repo disconnect --account --provider bitbucketWhat access is used for
| Access | Why it is needed | When it is used |
|---|---|---|
| Read repository contents | To fetch the commit being scanned | Every scan |
| Read repository metadata | To list branches and commits | cf branches, cf commits, the workspace |
| Write repository contents | To create the branch and commit a patch | Only when you publish a fix |
| Read and write pull requests | To open a pull request and merge it | Only when you publish or merge |
Disconnecting
cf repo list
cf repo disconnect acme/api
cf repo disconnect --account --provider github
cf provider disconnect gitlabDisconnecting one repository stops it being scanned and removes it from the workspace. Disconnecting the account removes the connection itself, so no repository from that account can be scanned until you connect it again.
You can also revoke access from the provider's own settings at any time, without going through Cefense. That is the stronger action, and it takes effect immediately.
Deleting everything
Deleting your Cefense account revokes the provider grants, removes the app installation, and deletes your repositories, scans, findings, and fixes. See Security and data handling.
Have a correction or need help?
Email the docs team