Git Repository

Scan the source, configuration, and documents on one branch of any Git repository — GitHub, GitLab, Bitbucket, Azure DevOps, or self-hosted.

Category: Code Repositories
Source type: GIT
Produces: fileimageaudiovideoarchive
Links: GitProduct GitHub personal access tokensCredentials GitLab deploy tokensReference Bitbucket app passwordsReference

Source repositories are where credentials go to hide — a key in a config file, a token in a test fixture, a customer export committed “just for debugging”. This source scans the files on one branch of a repository, provider-agnostically.

What you need to connect

A repository URL. Everything is done over the standard Git protocol rather than a provider API, so GitHub, GitLab, Bitbucket, Azure DevOps, Gitea and a bare repository on a server are all the same source.

Auth method	What you supply
None	Nothing — a public repository over HTTPS
Token	A personal access, deploy, or app installation token with read access
Basic	Username and password
SSH key	An OpenSSH private key, optional passphrase, and `known_hosts`
Client certificate	A PEM certificate and key, for mutual-TLS servers

For an internal server with a private CA, paste the CA bundle rather than turning off certificate verification.

What Classifyre reads

The files on one branch or tag — the working tree, not the history. Scan a second branch by adding a second source.

Narrow it with include and exclude path globs (src/config, **/*.sql, node_modules) and extension filters. .env, .py, .yaml, .tf and .sql are usually where the interesting things are.

Shared behaviour · File and object sources

Every object in the repository becomes one asset. What it is — a PDF, a spreadsheet, a screenshot, a video — is worked out from the bytes themselves, not from the file name, because storage systems routinely label everything as generic binary data. The full list of readable types is on File Formats.

Files hidden inside other files are pulled out and scanned in their own right: images embedded in a document, and every member of a ZIP, TAR, 7z or RAR archive. Images, audio and video need OCR and transcription switched on before their content can be read.

Large objects are streamed rather than loaded whole, so a multi-gigabyte file costs disk rather than memory, and only the part a sampling window asks for is read.

Files in this repository are read with the shared file pipeline: see Supported File Formats for everything it can open, and OCR & Transcription for reading text out of images, audio and video.

Metadata on every asset

Asset kind · file

Field	Type	Always present	What it is
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
provider	string	Yes	Storage provider label
object_key	string	Yes	File path relative to the repository root
repository_url	string	Yes	Repository the file was read from, with any credentials removed
branch	string	No	Branch or tag that was scanned
commit_sha	string	No	Commit the file was read at
blob_id	string	No	Git object id (OID) of the file blob — a hash of its contents
etag	string	No	Content digest of the file: the Git blob OID
size_known	boolean	No	False when the file's bytes were not part of the initial transfer, so its size was not known at discovery time
lfs_pointer	boolean	No	True when the tracked file is a Git LFS pointer rather than the payload
web_url	string	No	Browser-accessible URL for the file, when the host is recognised
source_hash	string	No	Hash of the parent asset (embedded files and archive members only)
location	string	No	Location within the parent (embedded file location or archive member path)

Asset kind · image

Field	Type	Always present	What it is
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
provider	string	No	Storage provider label
object_key	string	No	File path relative to the repository root
repository_url	string	No	Repository the file was read from, with any credentials removed
branch	string	No	Branch or tag that was scanned
commit_sha	string	No	Commit the file was read at
blob_id	string	No	Git object id (OID) of the file blob — a hash of its contents
etag	string	No	Content digest of the file: the Git blob OID
size_known	boolean	No	False when the file's bytes were not part of the initial transfer, so its size was not known at discovery time
lfs_pointer	boolean	No	True when the tracked file is a Git LFS pointer rather than the payload
web_url	string	No	Browser-accessible URL for the file, when the host is recognised
source_hash	string	No	Hash of the parent asset (embedded files and archive members only)
location	string	No	Location within the parent (embedded file location or archive member path)

Asset kind · audio

Field	Type	Always present	What it is
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	File path relative to the repository root
repository_url	string	Yes	Repository the file was read from, with any credentials removed
branch	string	No	Branch or tag that was scanned
commit_sha	string	No	Commit the file was read at
blob_id	string	No	Git object id (OID) of the file blob — a hash of its contents
etag	string	No	Content digest of the file: the Git blob OID
size_known	boolean	No	False when the file's bytes were not part of the initial transfer, so its size was not known at discovery time
lfs_pointer	boolean	No	True when the tracked file is a Git LFS pointer rather than the payload
web_url	string	No	Browser-accessible URL for the file, when the host is recognised
source_hash	string	No	Hash of the parent asset (embedded files and archive members only)
location	string	No	Location within the parent (embedded file location or archive member path)

Asset kind · video

Field	Type	Always present	What it is
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	File path relative to the repository root
repository_url	string	Yes	Repository the file was read from, with any credentials removed
branch	string	No	Branch or tag that was scanned
commit_sha	string	No	Commit the file was read at
blob_id	string	No	Git object id (OID) of the file blob — a hash of its contents
etag	string	No	Content digest of the file: the Git blob OID
size_known	boolean	No	False when the file's bytes were not part of the initial transfer, so its size was not known at discovery time
lfs_pointer	boolean	No	True when the tracked file is a Git LFS pointer rather than the payload
web_url	string	No	Browser-accessible URL for the file, when the host is recognised
source_hash	string	No	Hash of the parent asset (embedded files and archive members only)
location	string	No	Location within the parent (embedded file location or archive member path)

Asset kind · archive

Field	Type	Always present	What it is
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	File path relative to the repository root
repository_url	string	Yes	Repository the file was read from, with any credentials removed
branch	string	No	Branch or tag that was scanned
commit_sha	string	No	Commit the file was read at
blob_id	string	No	Git object id (OID) of the file blob — a hash of its contents
etag	string	No	Content digest of the file: the Git blob OID
size_known	boolean	No	False when the file's bytes were not part of the initial transfer, so its size was not known at discovery time
lfs_pointer	boolean	No	True when the tracked file is a Git LFS pointer rather than the payload
web_url	string	No	Browser-accessible URL for the file, when the host is recognised
source_hash	string	No	Hash of the parent asset (embedded files and archive members only)
location	string	No	Location within the parent (embedded file location or archive member path)

Lineage

This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.

Worth knowing

Nothing is shared between runs. Each scan clones into its own throwaway workspace, so a scan can never be poisoned by a previous one.
Clone strategy controls the transfer cost. The default fetches the file tree plus the contents it needs rather than the whole history — a repository with a large past is not a large download.
Last-commit dates per file are optional; they’re what Latest sampling orders by, and they cost an extra pass over the branch.
Credentials never reach the disk in the clear, and are redacted from any Git error the scan reports.

Configuration

Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.

Required

Without these, the source will not save.

Field	Type	Required	What it does	Default
required	object	Yes	—no extra properties	—
repository_url	string	Yes	Repository to scan. Works with GitHub, GitLab, Bitbucket, Azure DevOps, Gitea and any other Git server. Accepts https://host/org/repo.git, ssh://git@host/org/repo.git, or the scp-style git@host:org/repo.git.	—

Secrets

Stored encrypted and never shown again after you save them. See Configuration & Fields.

Field	Type	Required	What it does	Default
masked	object	No	Secrets for the selected authentication method. Leave the whole block empty for a public repository. Every value is encrypted at rest and only ever materialised into a private, per-run directory that is deleted when the scan ends.no extra properties	—
ca_certificate_pem	string	No	PEM certificate authority bundle used to verify the server, for an internal Git server with a private CA. Applies to any http(s) authentication method.	—
client_certificate_pem	string	No	PEM client certificate for mutual-TLS authentication.	—
client_key_pem	string	No	PEM private key matching the client certificate.	—
password	string	No	Password for basic authentication.	—
ssh_private_key	string	No	OpenSSH private key in PEM form, including the BEGIN and END lines. Used with an ssh:// or git@host:org/repo.git URL.	—
ssh_private_key_passphrase	string	No	Passphrase protecting the SSH private key, when it has one.	—
token	string	No	Personal access token, deploy token or app installation token with read access to the repository.	—
username	string	No	Username for basic authentication, or the token user for token authentication. Optional for tokens: the correct user for the detected host is used when this is empty (x-access-token for GitHub, oauth2 for GitLab, x-token-auth for Bitbucket).	—

Optional

Everything you can tune. Sensible defaults apply when you leave them alone.

Field	Type	Required	What it does	Default
optional	object	No	—no extra properties	—
auth	object	No	Which credentials to use and how the server is verified.no extra properties	—
auth.auth_method	enum	No	How the scan authenticates to the Git server. none scans a public repository over http(s). token uses a personal access / deploy token (GitHub, GitLab, Bitbucket, Azure DevOps). basic uses a username and password. ssh_key uses an SSH private key with an ssh:// or git@host:org/repo.git URL. client_certificate uses mutual TLS against an enterprise Git server. Credentials are never written to the runner's git configuration: they are materialised into a private, per-run directory that is deleted when the scan ends. Allowed: none, token, basic, ssh_key, client_certificate	none
auth.ssh_known_hosts	string	No	known_hosts entries for the Git server, one per line (the output of ssh-keyscan host). Required for SSH unless host key checking is turned off.	—
auth.ssh_strict_host_key_checking	boolean	No	Refuse to connect over SSH to a host that is not in ssh_known_hosts. Leave on unless you are connecting to a server whose host key you cannot pin.	true
auth.verify_ssl	boolean	No	Verify the server's TLS certificate on http(s) remotes. Turn off only for an internal server with a self-signed certificate; prefer ca_certificate_pem.	true
connection	object	No	How the repository is transferred and how much of one file may be held at once. Every run clones into its own empty directory and deletes it afterwards — nothing is shared or cached between runs or between sources.no extra properties	—
connection.clone_strategy	enum	No	How much of the repository is transferred up front. blob_limit (recommended) fetches the file tree plus the contents of every file at or below the memory threshold in one pack, and leaves larger files to be fetched individually only if the scan reaches them. blobless fetches the file tree only, so every file is catalogued from Git metadata and downloaded one at a time as it is scanned — the cheapest option for a very large repository where only a slice is sampled, at the cost of one request per file and unknown file sizes until a file is read. full transfers every file in the commit up front. Allowed: blob_limit, blobless, full	blob_limit
connection.clone_timeout_seconds	number	No	Time limit for the initial clone.min 30, max 86400	1800
connection.command_timeout_seconds	number	No	Time limit for each subsequent Git command, including fetching one file.min 5, max 3600	300
connection.depth	integer	No	How many commits of history to fetch. 1 (default) fetches only the commit being scanned. 0 fetches the full history, which is what per-file commit dates need.min 0, max 1000	1
connection.max_archive_member_bytes	integer	No	Maximum uncompressed bytes read from a single archive membermin 1024	10485760
connection.max_archive_members	integer	No	Maximum member files expanded from one archive into child assets. Bounds fan-out, and is the guard against a zip bomb.min 1, max 10000	200
connection.max_archive_total_bytes	integer	No	Maximum uncompressed bytes read across all members of one archive. The decompression-ratio ceiling: a zip bomb hits this before it hits memory.min 1024	104857600
connection.max_embedded_files	integer	No	Maximum embedded files (parquet image/audio columns, office media) expanded from one container into child assets per runmin 1, max 10000	200
connection.max_file_bytes	integer	No	Refuse any file larger than this many bytes. 0 or unset means no limit: a file above max_object_bytes is spooled to disk rather than held in memory, so file size is bounded by free disk, not by RAM.min 0	—
connection.max_object_bytes	integer	No	Maximum bytes of one file held in memory. Larger files are streamed to a temporary file, so this bounds memory rather than the size of file that can be scanned. Also the threshold used by the blob_limit clone strategy. See max_file_bytes to refuse large files outright.min 1024	26214400
scope	object	No	Which branch is read and which files inside it become assets. One branch is scanned per source; add a second source to scan a second branch.no extra properties	—
scope.branch	string	No	Branch or tag to scan, for example main or release/2026-01. Defaults to the repository's default branch.	—
scope.exclude_extensions	array	No	Optional extension denylist (for example, .png, .lock, .min.js)	—
scope.exclude_extensions[]	string	No	—	—
scope.exclude_paths	array	No	Folders or glob patterns to skip, for example node_modules, vendor or */fixtures/. Applied after include_paths, so an excluded folder inside an included one is still skipped.	—
scope.exclude_paths[]	string	No	—	—
scope.include_content_preview	boolean	No	Read file contents to infer type and extract detector-ready text. Turn off for a metadata-only inventory of the repository.	true
scope.include_empty_objects	boolean	No	Include zero-byte files in extraction results	false
scope.include_extensions	array	No	Optional extension allowlist (for example, .py, .sql, .env, .md)	—
scope.include_extensions[]	string	No	—	—
scope.include_last_commit	boolean	No	Record each file's own last-commit date, which is what LATEST and AUTOMATIC sampling order by. Needs the branch's commit history, so it makes the initial transfer larger. When off, every file inherits the date of the scanned commit.	false
scope.include_object_metadata	boolean	No	Attach Git metadata (blob object id, size, commit) to asset checksums. The blob id is a content hash, so leaving this on lets an unchanged file be skipped on the next run without re-reading it.	true
scope.include_paths	array	No	Folders or glob patterns to scan, for example docs, src/config or */.sql. A file is kept when it matches at least one entry. Leave empty to scan the whole repository.	—
scope.include_paths[]	string	No	—	—