Setup version control system
We take data security very seriously. Your code will sit on your premises and go to a model that you control, sitting in your cloud.
GitHub
Our platform requires access token to fetch repositories for scan. Github provides two kinds of access token:
Fine-Grained Personal Access Token is recommended if the user is the Owner of the repository OR the user is Member of an Organisation which owns the repository.
Classic Personal Access Token can be used for all use-cases but is recommended for users that are collaborators to repository that are to be scanned.
The type of token to be used on our platform depends on the type of affiliation the user has with the repository you want to scan. Please follow the instructions in order to generate a token with minimum required permissions.
Issuing a Fine-Grained Personal Access Token
If the repository is a part of an organisation, ensure that fine-grained access tokens are enabled for the organisation. You can follow the documentation on Github.
Fine-Grained Access Token can only be enabled by the admins of the organisation
Fine-Grained Access Tokens can only be associated to a single owner (username of organisation)
Go to the fine-grained tokens page: github.com/settings/personal-access-tokens
Click on
Generatenew token.Enter account credentials if asked.
Add
Token name. e.g.p0-scan-read-onlyChoose the
Resource OwnerIf the you own the repository: Choose the username from the dropdown
If the repository is owned by an organisation: Choose the organisation from the dropdown
[Optional] Add a description
[Optional but good practice] Add
What is this token for?This helps organization's administrators in understanding your request when they review it for approval.
For
Repository access, choose either between:[Recommended]
Only select repositories: Select repositories that you want the tool to include in the scan.or
All repositories: For all repositories you have access to (public and private)
In
Permissions, we require the following permissions at miniumum:Repository Permissions→Contents: Read-OnlyandMetadata: Read-OnlyThis ensures that the token has minimum required permissions to run a scan.
Click on
Generate token.Copy the token displayed on next page
Note: You may have to click on
Generate token and request accessif you are issuing a token for an organisation and it requires approval. In this case, please ask an admin to approve the request. The token will be available once the request has been approved.
Issuing a Classic Personal Access Token
Issuing a Classic Personal Access Token
If the repository is a part of an organisation, ensure that personal access tokens (classic) are not restricted by organisation. You can follow the documentation on Github.
Go to the classic tokens page: github.com/settings/tokens
Click on
Generate new tokendropdown and chooseGenerate new token (classic)Add a note. e.g
p0-scan-read-onlyChoose the expiration of the token from the dropdown
Mark the
Repocheckbox, it should auto-accept all of it sub-permissions:repo: status,repo_deployment, etc. This step is crucial so that the token has the minimum required permissions to run a scan.Click on
Generate tokenand copy the token displayed on the next page.
Note: Any policy change about personal access tokens can only be performed by the admins of the organisation.
GitHub Enterprise Server
Our platform requires access token to fetch repositories for scan. Github Enterprise provides two kinds of access token:
Fine-Grained Personal Access Token is recommended if the user is the Owner of the repository OR the user is Member of an Organisation which owns the repository.
Classic Personal Access Token can be used for all use-cases but is recommended for users that are collaborators to repository that are to be scanned.
The type of token to be used on our platform depends on the type of affiliation the user has with the repository you want to scan. Please follow the instructions in order to generate a token with minimum required permissions.
Issuing a Fine-Grained Personal Access Token
If the repository is a part of an organisation, ensure that fine-grained access tokens are enabled for the organisation. You can follow the documentation on Github.
Fine-Grained Access Token can only be enabled by the admins of the organisation
Fine-Grained Access Tokens can only be associated to a single owner (username of organisation)
Go to the fine-grained tokens page on your
Github Instance>Settings>Personal Access TokenClick on
Generatenew token.Enter account credentials if asked.
Add
Token name. e.g.p0-scan-read-onlyChoose the
Resource OwnerIf the you own the repository: Choose the username from the dropdown
If the repository is owned by an organisation: Choose the organisation from the dropdown
[Optional] Add a description
[Optional but good practice] Add
What is this token for?This helps organization's administrators in understanding your request when they review it for approval.
For
Repository access, choose either between:[Recommended]
Only select repositories: Select repositories that you want the tool to include in the scan.or
All repositories: For all repositories you have access to (public and private)
In
Permissions, we require the following permissions at miniumum:Repository Permissions→Contents: Read-OnlyandMetadata: Read-OnlyThis ensures that the token has minimum required permissions to run a scan.
Click on
Generate token.Copy the token displayed on next page
Note: You may have to click on
Generate token and request accessif you are issuing a token for an organisation and it requires approval. In this case, please ask an admin to approve the request. The token will be available once the request has been approved.
Issuing a Classic Personal Access Token
Issuing a Classic Personal Access Token
If the repository is a part of an organisation, ensure that personal access tokens (classic) are not restricted by organisation. You can follow the documentation on Github.
Go to the classic tokens page on your
Github Instance>Settings>TokensClick on
Generate new tokendropdown and chooseGenerate new token (classic)Add a note. e.g
p0-scan-read-onlyChoose the expiration of the token from the dropdown
Mark the
Repocheckbox, it should auto-accept all of it sub-permissions:repo: status,repo_deployment, etc. This step is crucial so that the token has the minimum required permissions to run a scan.Click on
Generate tokenand copy the token displayed on the next page.
Note: Any policy change about personal access tokens can only be performed by the admins of the organisation.
GitLab
The Access Tokens allow P0 to access the repositories in your account or organisation that we will run the scan on. As the P0 process is running in your cloud, no code leaves your premises and you can set policies around egress to ensure this. Gitlab provides three kinds of access tokens:
Personal Access Token is recommended if the user is personally the owner of the repository or if you want to access all repositories accessible to user.
Project Access token should be used when most of the repositories that are needed to be accessed are within a gitlab project.
Group Access Token should be used when the repositories to be scanned are across different projects and a group has access to those projects.
The type of token to be used on our platform depends on the level of access required for scanning the intended repositories.
Issuing a Personal Access Token
On the left sidebar, select your avatar.
Select
Edit profile.On the left sidebar, select
Access tokens.Select
Add new token.In
Token name, enter a name for the token.[Optional] In
Token description, enter a description for the token.In
Expiration date, enter an expiration date for the token.The token expires on that date at midnight UTC. A token with the expiration date of 2024-01-01 expires at 00:00:00 UTC on 2024-01-01.
If you do not enter an expiry date, the expiry date is automatically set to 365 days later than the current date.
By default, this date can be a maximum of 365 days later than the current date. In GitLab 17.6 or later, you can extend this limit to 400 days.
Select the desired scopes.
Please select at least
api,read_repositoryread_apiscopes for the token.
Select
Create personal access token.
Save the personal access token somewhere safe. After you leave the page, you no longer have access to the token.
Issuing a Classic Personal Access Token
Issuing a Project Access Token
On the left sidebar, select
Search or go toand find your project.Select
Settings>Access tokens.Follow steps 3 to 9 in the Issuing Personal Access Token.
Issuing a Classic Personal Access Token
Issuing a Group Access Token
On the left sidebar, select
Search or go toand find your group.Select
Settings>Access tokens.Follow steps 3 to 9 in the Issuing Personal Access Token.
Bitbucket
The Access Tokens allow P0 to access the repositories in your account or organisation that we will run the scan on. As the P0 process is running in your cloud, no code leaves your premises and you can set policies around egress to ensure this. There are three types of Access Token available for Bitbucket Cloud:
Repository Access Tokens — Provides access to a single repository with the permissions specified at the time of creation.
Project Access Tokens (Premium feature) — Provides access to a single project and the repositories in it. The access permissions (or scopes) are specified at the time of creation.
Workspace Access Tokens (Premium feature) — Provides access to a single workspace and the repositories and projects in it. The access permissions (or scopes) are specified at the time of creation. Workspace Access Tokens can be used for accessing the repositories in a single workspace.
Issuing a Repository Access Token
At bitbucket.org or at your on-prem deployment’s url, navigate to the target repository for the Access Token. This repository is the only one that the Repository Access Token can access.
On the sidebar, select
Repository Settings.On the sidebar, under
Security, selectAccess tokens.Select
Create Repository Access Token.Give the Repository Access Token a name, usually related to the app or task that will use the token.
Select at least the permission
Repo: readfor it to work with p0. For detailed descriptions of each permission, see Repository Access Token permissions.Select the
Createbutton. The page will display theRepository Access Token createddialog.Copy the generated token and either record or paste it into the app that requires access.
The token is only displayed once and can't be retrieved later. Rather than recovering or reusing a Repository Access Token, create a new token and consider revoking the old token.
Issuing a Classic Personal Access Token
Issuing a Project Access Token
At bitbucket.org or at your on-prem deployment’s url, navigate to the target project for the Access Token. This project is the only one that the Project Access Token can access.
On the sidebar, select
Project settings.On the sidebar, under
Security, selectAccess tokens.Select
Create Project Access Token.Follow steps 5 to 9 from Issuing a Repository Access Token
Issuing a Classic Personal Access Token
Issuing a Workspace Access Token
At bitbucket.org or at your on-prem deployment’s url, navigate to the target project for the Access Token. This project is the only one that the Project Access Token can access.
On the sidebar, select
Settings.On the sidebar, under
Security, selectAccess tokens.Select
Create Workspace Access Token.Follow steps 5 to 9 from Issuing a Repository Access Token