Skip to main content

​
Overview

Repositories, under Assets in the sidebar, lists the repositories you can view as a risk table with the columns Repository, Open findings, Fix now, Exploit evidence and Protection. You can search with Search repositories… and narrow the list by Severity and Provider. Sort orders it by Risk, Open findings, Name or Last scan. To add repositories, click Add repository at the top of the page, or choose Add repository from the + Create menu in the sidebar. Both need the Create Repositories permission. The page is shown to members with the View Repository permission. See Navigating ZeroPath for the sidebar. The list follows the repository filter in the top bar. It opens with the riskiest repositories first.

​
The risk table

Each row is one repository. Click a row, or the repository name, to open the repository page. A dash in Open findings, Fix now or Exploit evidence means the repository has none.

​
What Open findings counts

Open findings counts the same findings as the Open group of the Issues page for that repository: findings in Needs review or Backlog, from full scans, in every category except Containers. The count comes from the repository’s most recent full scan and dependency scan. Findings in Reviewing or Patching are in the In progress group, so they are not counted here. The Fix now and Exploit evidence columns count findings from the same open set.

​
Row action

The last column has one action, picked from the repository’s state:

​
Search, filters and sort

  • Search repositories… matches repository names.
  • Severity shows only repositories with at least one open finding of the chosen severity: Critical, High, Medium or Low. Any severity clears it.
  • Provider shows only repositories from one provider, such as GitHub or GitLab. Each option shows how many repositories match the search and severity filter. Any provider clears it.
  • Sort sets the order:
The pager under the table shows 25 repositories per page and states the order, for example “1–25 of 77 repositories, riskiest first”. The search, filters, sort and page are kept in the page URL, so you can bookmark or share a view.

​
Bulk actions

Select repositories with the checkbox on each row, or with the checkbox in the header for the whole page. Shift-click selects a range. Select all selects every repository that matches the current search and filters, across all pages. Deselect all clears the selection. With repositories selected, the Action menu offers: When you open the menu, it shows Checking available actions… while ZeroPath checks your permissions on the selection. An action you cannot run on every selected repository is disabled with the note “You need this permission on every selected repository.” Delete is also disabled while researcher mode is on. For organizations billed in credits, if a scan cannot start for lack of credits, ZeroPath shows Confirm scan cost with a quote before starting the scans.

​
Protection

The Protection column shows whether a repository’s scan settings keep it covered. Its status ignores open findings. Click the status to open the Protection panel. It lists: Next to each missing recommended setting, a button turns it on for the repository:
  • Set weekly creates a repository scan schedule that runs a full scan of the default branch every Sunday at 00:00 UTC. It needs the Create/Edit Scan Schedule permission. Scheduled scans use credits for organizations billed in credits.
  • Turn on next to PR scanning turns on PR scanning. It needs the Toggle PR Scanning permission.
  • Turn on next to PR comments turns on PR comments. It needs the Toggle PR Summaries permission.
For a Partial repository, Turn on recommended turns on every missing setting you have permission for, in one click. The change applies right away, with no confirmation. If it fails, the panel goes back to the previous value and shows an error. Buttons appear only for the settings you have permission to change. All settings opens the repository’s Settings tab, where you can choose another schedule. See Scan Scheduling.

​
Monorepos

Monorepos, at the top of the page, opens the page where you split one repository into directory partitions with separate findings, settings, and schedules. See Monorepo partitions for setup and scan behavior.

​
Repository migration history

When you open Add repository, a Repository migration history panel may appear above the repository picker. It records proposals to re-point an existing ZeroPath repository onto a new GitHub location — for example, when a repository moves to a different GitHub organization and the new location is imported.

​
How proposals are detected

ZeroPath compares each candidate repository against your already-imported repositories. A proposal is raised when:
  • The repository path (owner/repo) matches another imported repository on the same or a different GitHub host, or
  • The repository name matches an imported repository on a different GitHub organization, and the commit history confirms they are the same codebase (matching root commit or head commit SHA).
The second path covers cross-organization migrations: if your organization moved repositories from one GitHub organization (or GitHub Enterprise Server instance) to another, ZeroPath detects the relationship from commit evidence rather than requiring an identical path.

​
Evidence and verdicts

Each proposal in the panel shows a verdict badge and, when you expand Show history evidence, the individual signals the resolver matched on:

​
Acting on a proposal

For each Needs review proposal:
  • Approve re-point — moves the existing repository and all its findings, triage state, and settings onto the new GitHub location. Available only when shared history is proven (root or head commit match).
  • Not the same repo — records a permanent override so the resolver never proposes this pair again.
The panel collapses by default; click it to expand. A badge shows how many proposals are waiting for review.

​
History probe

When a proposal has not yet been confirmed by commit evidence, the panel shows Name match only — history not compared yet. Click Probe histories to queue a background job that fetches the root-commit SHA from both sides and updates the evidence. The panel polls automatically and folds the new evidence into the proposals once the job finishes. If the probe is already running (started by another session or a background schedule), the panel attaches to the running job. A probe result of Same history — proven means Approve re-point becomes available. A result of Different history — cannot re-point means these repositories do not share a git history, and only Not the same repo is offered.

​
Repository page

Open a repository to see its page. The header shows the repository name and provider. It also shows a Wiz Connected badge when your organization has Wiz connected, the Security Compass logo for a linked repository, and Unlinked for a GitHub repository whose connection is broken. The header has these actions:
  • Explore latest scan opens the repository’s most recent full scan in the scan explorer.
  • Scan repository opens the scan dialog, where you pick the branch to scan. For an uploaded repository, this button reads Upload & scan and opens the upload dialog.
  • An arrow button opens the repository in its version control provider, in a new tab.
When the last full scan failed, a warning under the header explains the failure. It links to Review Git connections or Review scan branch when one of those can fix it, and to Scan details, which opens that scan in the scan explorer. The page has these tabs: The page opens on the Scans tab.