Skip to main content
You attach source code in the Target & scope step of the Add application wizard. You can also add or change it later from Configure on the application page. There are two ways to give the agent your code. You can use one or both.

​
Option 1: GitHub repositories

Use this option if your code is on GitHub. The agent copies the latest version of the default branch at the start of every scan, so each scan tests your current code.
1

Connect GitHub

Open Integrations and click Connect on the GitHub card. GitHub asks you to install the NoScope app on your GitHub organization. Choose which repositories NoScope can access, then approve. See Connect GitHub.
2

Select repositories

In the Target & scope step, the GitHub Repositories section lists every repository the NoScope app can access. Each one shows its main language and a Private or Public badge. Tick the repositories that belong to this application.
3

Save the application

The next scan copies the selected repositories and runs the source review before the live pentest.
If GitHub is not connected, the Target & scope step shows a Source Code card with a Go to Integrations link.

​
Option 2: Source zip files

Use this option if your code is not on GitHub, or if you want to test a specific version.
1

Prepare the zip files

Create one zip file per repository. Include the source code and any configuration files and documentation that explain how the application runs.
2

Upload them

In the Source zip files section, click Upload zip and choose your files. A progress bar shows each upload.
3

Run a scan

The next scan extracts the zip files and reviews the code. When that scan ends, the zip files are deleted. Upload them again for the next scan.

​
Limits

  • Only .zip files.
  • Up to 10 zip files per application.
  • Up to 5 GB per zip file.
  • Up to 20 GB of code in total after the files are extracted.

​
Tips for better results

  • Select only the repositories that run this application. Extra repositories make the scan slower and add noise.
  • Keep a README, deployment files (for example Docker Compose, Helm values, or nginx configuration), and example configuration files in the repository or zip. The agent uses them to understand how the application is deployed.
  • If some code is not used in production, say so in the scope notes.

​
Stop sharing code

  • To stop using a repository for one application, untick it in Configure, then click Save changes.
  • To remove all GitHub access, open Integrations and click Disconnect on the GitHub card. You can also uninstall the NoScope app from your GitHub organization settings.
  • To remove an uploaded zip file before a scan, click the remove icon next to the file.