Processing of Access Token During Private Repo Scan

[rajrachani36]

I'm currently scanning a private Git repository using a CBOM tool, and I've provided a generated personal access token (PAT) to authenticate with the repository. I would like to confirm whether this access token is being processed and validated locally on my machine (i.e., within the scanning tool itself) or if it is being sent over the network to an external server or cloud service for authentication or further processing. Could you clarify the flow of this token and whether there are any potential data exposure risks during this scanning process?

[san-zrl]

Hi @rajrachani36,
Sorry for the late response and thank you for trying out CBOMkit. You enter credentials via the Authentication tab in Advanced options in the frontend. We pass on these credentials to JGit as they are. We do not log them nor do we store them anywhere.

[n1ckl0sk0rtge]

See #197