Connect source code (White Box)

Connect a repository (GitHub, GitLab or Bitbucket) for a deeper pentest. Optional.

In a White Box pentest you connect a source-code repository and the analysis correlates the code with the live target's behavior, deepening coverage. It is fully optional — the pentest works normally without it.

You connect the repository under Company → Settings → Repositories, then select it in the source-code step when requesting a test.

Supported providers

GitHub, GitLab and Bitbucket (cloud). The connection uses each provider's official App/OAuth: you authorize through the provider itself, without pasting tokens into the platform.

How to connect

1. Connect: under Settings → Repositories → Connect repository, pick the provider and authorize read-only access, selecting only the repositories that belong in the test.
2. Select: when requesting a test, check the repository in the source-code step.
3. Revoke anytime: the connection can be switched off at any moment in settings, and the repository stops being read in tests. To also withdraw the app's authorization, open your provider's app settings: on GitHub the path is Settings → GitHub Apps, both for the account and for the organization.

On GitHub, two things commonly block the connection. On the authorization screen, choose "Only select repositories" and tick the repositories for the test: for security, HAS does not accept access to every repository in the account. And if the repository belongs to an organization, whoever authorizes it needs permission to install apps there; without it GitHub only files an approval request to an administrator, and the connection completes once they approve. After fixing either one on GitHub, come back to this screen and click Connect repository again.

Your code's privacy

Access is read-only. We do not store your source code: it is used only during test execution and discarded at the end. We keep only the connection link, so we can read the repository in future tests. Switching that link off in settings ends the repository's use by HAS; the authorization granted to the app stays with the provider until you remove it there.

When to use it

It is ideal to deepen the test of an application you develop and whose code you have access to. If you don't have the source code (for example, testing a third-party system), just proceed with Black Box or Gray Box as usual.