If you don’t connect your code repository to ComplyJet, your version control and vulnerability checks can’t run automatically. Instead, you activate a few manual documents and upload evidence for them. The steps below cover both.
Step 1: Activate the version control documents
Go to Tests in the left sidebar and open the Excluded tab.
Search for
version.Select the documents below and click Activate.
Version and change control user permissions
Version control settings
Version control security settings
Version control system access review — no need to activate (see the note below)
No need to activate “Version control system access review”. You’ll perform access reviews from the access module under Organisation instead.
Step 2: Add your repositories
Go to Security → Code → More Options and choose Create Repository or Import via CSV.
From your code repository, export the names of your repositories (one per row) to use for the import.
Step 3: Upload evidence for each document
The documents you activated are the ones you upload evidence to. Open each document and check its Instructions tab — it explains exactly what the file needs to contain and has a template you can download.
Version and change control user permissions
Provide a list of who has admin vs. non-admin access in your version control system (e.g., GitHub), and what each group can do. Your file should show:
Who has admin access and who has non-admin access
What each role can do
That it reflects your current team, not an outdated snapshot
Version control settings
Upload screenshots, exports, or a report showing peer review, approval, and branch protection settings for any version control system not connected to ComplyJet. Show the repository or organization name, the relevant settings, and the date captured.
Acceptable evidence includes branch protection settings, required reviewer settings, merge approval rules, or a vendor-generated repository policy report. If only part of your development stack isn’t connected, clearly label which repositories or organizations the evidence applies to.
Version control security settings
Upload screenshots, exports, or a report showing the password, MFA, SSO, and session settings for any version control system not connected to ComplyJet. Show the organization or workspace name, the relevant settings, and the date captured.
Acceptable evidence includes MFA enforcement settings, SSO settings, organization security settings, or a vendor-generated identity and authentication report. If more than one version control system is in scope, provide separate, clearly labeled evidence for each one.
Vulnerability documents
Since you’re not connecting your code repository, vulnerabilities also won’t flow into the platform. A few documents cover this instead.
Go to Tests and open the Excluded tab.
Search for
vulnerabilities.Select the documents you see below and click Activate.
A process exists to identify and prioritize security vulnerabilities
Vulnerability Scan
Remediated vulnerabilities
Note: This article shows the documents across all frameworks, so you might not see all of them. Activate the ones that show up for you.
Upload evidence to each one you activated:
A process exists to identify and prioritize security vulnerabilities (optional)
Provide documentation describing how you identify, track, and prioritize security vulnerabilities — including how you stay aware of new threats from outside sources, like vendor alerts or security bulletins. If your automated vulnerability scanning already covers identifying issues and you handle prioritization informally, you may not need this one — activate it if you want to show a more structured, documented process. Your file should show:
How you identify vulnerabilities, including from external sources (vendor alerts, security bulletins, etc.)
How you prioritize and assign fixes
Examples of vulnerabilities being tracked through your ticketing workflow
Vulnerability scan
Provide a screenshot of results from your most recent vulnerability scan, showing which assets have vulnerabilities. Only upload this if you scan with a tool ComplyJet isn’t connected to. If you use one of our vulnerability scanner integrations, ComplyJet already tracks this automatically. Your file should show:
The assets scanned
Any vulnerabilities found, with type and severity
The scan date
Remediated vulnerabilities
Provide evidence that a high-severity finding from a recent vulnerability scan was fixed — usually a ticket showing what was found, what was done about it, and when. Provide a remediation ticket or report for a high-severity vulnerability from your most recent scan, showing:
What was found and when
The remediation steps taken
When it was resolved
If you need any assistance activating these documents, reach out to our support team.