Repositories reference
Repositories at /app/repos lists your organization’s connected repositories, the branches and tags its applications use, and their scan status.
Last verified on October 28, 2026.
Access and scope
Section titled “Access and scope”Viewers can read this page. Members and administrators can add and remove repositories, reconnect access, change public-watch pins, and review moved tags. Viewers see View only — you cannot add or remove repositories.
Importing a repository makes it available for application setup. Repositories outside an application are not scanned. Add a repository to an application and choose an exact branch or tag to start analyses.
Tracked-branch limits are organization-wide: Starter allows 5, Pro 75, and Team 300. Sharing the same source between applications does not consume another tracked branch.
See Your first scan for connection setup and Manage applications for source selection and scan allowances.
Summary cards
Section titled “Summary cards”The cards describe the organization’s repositories, independently of the text filter.
| Card | Meaning |
|---|---|
| Tracked branches · Starter, Tracked branches · Pro, or Tracked branches · Team | Organization usage shown as an exact count out of the plan limit. The bar changes to a warning color at 80% usage. Select the card to open Billing in Settings. The card is hidden when usage data is unavailable. |
| Scans · last 24 hours | The main number counts successful scan jobs completed during the last 24 hours. The caption also reports failed jobs completed in that period and jobs currently refreshing. Refreshing includes running jobs and queued jobs ready to run; it excludes jobs scheduled for a future time. |
| Need attention | Distinct repositories with lost access, failed scans, or tags that changed commit. A repository counts once in the total even if several references need attention. The category counts can overlap. |
| Not in any application | Active connected repositories that no application currently uses. These repositories are not scanned or counted as current application results. |
The scan bar shows the relative numbers of successful, failed, and refreshing jobs. If scan counts are unavailable, the card shows — and Scan counts unavailable.
The scan caption’s repository-failure link counts repositories whose latest scan failed. This differs from the number of failed scan jobs in the last 24 hours: one repository can have several attempts, and its latest failure can be older than that window.
Select Need attention, the repository-failure link, or Not in any application when linked to narrow the list. The active view appears after Showing:; select Clear to remove it. Entering or leaving one of these views clears the text search. The unattached-repository card becomes a link only when the loaded list can account for its count.
Repository list
Section titled “Repository list”Repositories are grouped alphabetically. Each followed branch or tag has its own row. Additional references appear under ↳ same repository. A source shared across applications appears once, with each application and environment listed under Used by.
| Column | What it shows |
|---|---|
| Repository | Repository name and hosting service, followed by Branch or tag: and its reference type and name where applicable. Select the repository name to open its details. |
| Used by | Applications and environments using the source. Select an entry to open that application with the environment selected. Detached sources show Not used by any application. |
| Status | Scan, access, or reference state, with dated context when available. Select a source’s status to open the repository’s recent scan history. |
| Open findings | Counts in critical, high, medium, and low order, with a proportional severity bar. — means no applicable published result is available; it does not mean zero findings. |
Filter repositories
Section titled “Filter repositories”Filter repositories performs a case-insensitive text search across repository names, hosting services, branch or tag names, primary status text, and application and environment names. Leading and trailing spaces are ignored.
A matching reference keeps the entire repository group visible, including its other references. The search also applies within an active summary-card view.
No repositories match this filter. means the current filters have no matches.
Read open findings
Section titled “Read open findings”Active linked counts open Findings for the repository across all environments. When all consumers belong to one application, the link also limits results to that application.
These counts can include other tracked references in the same scope. When that happens, the row states Includes this repository’s other tracked refs. Do not add row counts together to calculate a repository total: their scopes can overlap.
Counts use published results and reflect the open findings in the linked scope. Historical counts are dimmed and are not linked. A pending scan or unsupported content can leave — instead of counts. Zero known findings does not establish that the repository is safe or completely covered.
See Understand the results for coverage and finding interpretation.
Status reference
Section titled “Status reference”| Status | Interpretation |
|---|---|
| Up to date | The source has a successful result. Read its date and coverage before drawing conclusions. No supported content means there was no supported content to analyze, rather than a clean vulnerability result. |
| Scan scheduled | A scan is queued for a future time. Previous results may remain visible. |
| Refreshing | A scan is running or queued and ready to run. This is not a completed result. |
| Not scanned yet | No current completed result is available and no active scan is indicated. |
| Not scanned | The connected repository has no followed reference represented in the list. |
| Last attempt failed | The latest attempt failed. Additional text may identify the last successful scan or when its grace period ends. |
| Retry scheduled, Retry queued, or Retry running | A retry exists. These statuses do not establish that fresh results are available. |
| The tag changed commit | A tag now points to a different commit. Results for the previously accepted commit remain historical until the change is reviewed and scanned. |
| Can’t access this repository | Access was lost. GitHub-specific statuses can identify a missing, suspended, or removed installation, or a repository not shared with the GitHub App. |
| Orphaned · historical results | No application currently uses the source. It is no longer scanned; retained results are historical. |
| Repository archived | The repository is archived in Perpensa. Any retained source counts are historical. |
After a GitHub App installation is suspended, access returns only when the installation is unsuspended on GitHub. Accepting new App permissions does not lift a suspension, and a removed installation stays removed until the App is installed again.
A failed source can temporarily retain results that still count during its grace period. Dimmed counts indicate historical results, including results affected by lost access, expired failure grace, a moved tag, or an orphaned source.
Relative times use whole minutes, hours, or days, rounding elapsed time down and future time up. Where dates are available, the status exposes exact UTC timestamps on hover and to assistive technology. Missing dates are omitted.
Add a repository
Section titled “Add a repository”Members and administrators can open Add repository.
| Menu choice | Purpose |
|---|---|
| GitHub | Import repositories through GitHub App access. |
| Forgejo / Gitea | Connect a self-hosted service using a token. |
| GitLab | Connect a hosted or self-hosted service using a token. |
| Bitbucket | Connect Bitbucket Cloud using an app password. |
| Track public repo, under Watch OSS | Add a public GitHub repository with a tag or branch pin. |
Availability depends on the connection and repository permissions. A provider appearing in the menu does not establish that access is configured.
After importing or tracking, verify that the repository appears in the list. Then configure its source in Applications. Adding a connection alone does not establish that a scan completed.
Follow Your first scan for provider import and public-watch steps.
Reconnect access
Section titled “Reconnect access”When Reconnect is available, select it to open the repository’s provider connection dialog. Repair the connection or repository permissions there.
Opening or closing the dialog does not prove access has been restored. Check the next source attempt and its dated status. Reconnect is not offered for archived repositories or public watches.
Review a moved tag
Section titled “Review a moved tag”- Select Review beside The tag changed commit.
- Check the previous and newly observed commit identifiers and every listed application and environment affected.
- Select Scan the new commit to accept that commit for the shared source and request its scan, or Not now to dismiss the review.
The preview shows the first 12 characters of each commit identifier. Confirmation applies to the shared source and its affected environments. It requests analysis; it does not mean the scan has finished or fresh findings are already available.
If Tag review is unavailable. appears, reopen Review to obtain a fresh preview before confirming. Scan allowances can prevent the action. Verify the outcome in the source’s status and recent scan history.
Change a public-watch pin
Section titled “Change a public-watch pin”For a public watch, open its row’s actions menu and select Change pin. Review the current pin, choose a different tag or branch, and select Confirm deployed version.
An unchanged pin cannot be submitted. Check the confirmation message, then choose the exact source in Applications to manage its analyses. A saved catalog pin does not establish that a new scan completed.
You can reopen Change pin to choose another reference. Changing the pin records what Perpensa should track; it does not change your deployed software or the upstream repository.
Remove a repository
Section titled “Remove a repository”Open the repository’s actions menu, select Remove, and confirm the named repository.
Removal archives the connection in Perpensa and removes its repository inventory, findings, and update candidates. It does not delete the repository from its hosting service. You can import it again later; re-importing is not an undo of deleted results.
Removal is blocked while an active repository scan prevents the change. A failure shows Remove failed with Could not remove this repository. Try again.
A successful action shows Repository removed. Check the refreshed list; retained source history may appear with Repository archived.
Loading and unavailable data
Section titled “Loading and unavailable data”Loading repositories… indicates that the page is still fetching data. No followed references yet. means there are no source rows to display; use Applications to configure a source.
Applications are unavailable. or Repository details are unavailable. means part of the page could not load. Previously loaded repository details may remain visible after a refresh failure, so their presence does not establish freshness. Let the page refresh or reload it before relying on those counts.
Continue with Manage applications to attach repositories and request source scans, or Your first scan to verify inventory and findings.