Skip to content

Git Clone Scanning (Optional)

SailPoint Entro's Git Clone capability enables faster scanning of full commit history by cloning repository data directly to the connector (Worker Group) to perform a full history scan directly from disk Instead of fetching commit diffs periodically via the source control API. This approach eliminates the performance and scale constraints of API-based scanning: local git operations are orders of magnitude faster than REST API calls, and there are no pagination limits or rate limits — SailPoint Entro can walk the entire commit history of every branch without throttling.

Supported Platforms

  • GitHub (Cloud and Enterprise Server)

  • GitLab

  • Bitbucket

Deployment Options

Git Clone scanning can be enabled in two deployment modes:

  1. Cloud connector — SailPoint Entro manages the connector infrastructure. Repositories are cloned within SailPoint Entro's cloud environment.

  2. Remote connector (customer-hosted) — The connector runs inside your own environment (e.g., on-premises or in your cloud account). Repositories are cloned locally within your infrastructure and never leave it. This is the recommended option for organizations with strict data residency requirements or air-gapped environments.

In both modes, cloned data stays in the connector's local storage and is not uploaded or transmitted externally.

To enable git clone for your organization, contact SailPoint Entro Support.

Rollout can be gradual: enable for specific account integration or the full organization.

How It Works

Git Clone scanning runs through six stages:

  1. Trigger — The SailPoint Entro Platform initiates a scan request for an integration.

  2. Discovery Scan — The connector orchestrates a discovery scan of the organization:

    • Lists all repositories in the organization

    • Enumerates branches per repository and triggers a git clone

    • Iterates the commit history on each branch

    • Extracts file diffs per commit

    • Sends each diff to the secret scanner engine

    • Enriches results with repo/commit metadata and encrypts detected secret values

  3. Clone Locally — A git server component clones each repository as a bare git repo onto a shared local disk volume. All reads happen from disk, not from the API.

  4. Secret Scanning — SailPoint Entro's engine scans each diff for exposed secrets. Detected secrets are reported back to the SailPoint Entro Platform with full context: repository, branch, commit, file path, and line number.

Security & Data Handling

  • Cloned repositories are stored as bare git repos on the connector's local disk volume

  • Clones are not uploaded anywhere — they remain scoped to the connector environment

    • Clones persist until the connector is deleted or manually removed

    • For the remote connector deployment, all data stays within your own infrastructure

  • Secret values detected during scanning are encrypted before being reported back to the SailPoint Entro Platform

​