Skip to main content
GitHub Container Registry (GHCR) is GitHub’s container registry for Docker images. CybeDefend integrates with GHCR to scan public and internal container images.
Supported Image Visibility:
  • ✅ Public images - Accessible to everyone
  • ✅ Internal images - Accessible within your organization
  • ❌ Private images - Not supported by CybeDefend

​
CybeDefend Configuration

Personal Access Token Required: A Personal Access Token with read:packages scope is required to scan internal container images. Public images can be scanned without authentication.
FieldDescriptionExample
GitHub UsernameYour GitHub username or organizationmyorg
Personal Access TokenGitHub PAT with read:packages scope (required for internal images)ghp_xxxxxxxxxxxx
DescriptionOptional description for the registryProduction GitHub Registry

​
How to Create a Personal Access Token (PAT) in GitHub

A Personal Access Token with the read:packages scope is required to scan internal container images. Public images can be accessed without authentication.
1

Access GitHub Settings

Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)
2

Generate New Token

Click Generate new token and select Generate new token (classic)
3

Select Scopes

Select the required scopes for internal container images:
  • ✅ read:packages (required for internal images)
  • Optional: write:packages (if you need write access)
4

Copy Token

Copy the generated token and paste it in CybeDefend
The Personal Access Token is only displayed once when created. Make sure to copy it immediately before leaving the page.

​
Security Best Practices

Use Fine-Grained Tokens

Prefer fine-grained PATs over classic tokens when possible for better security.

Minimal Scopes

Only grant read:packages scope for scanning operations.

Set Expiration

Always set an expiration date for your tokens to limit exposure.

Rotate Tokens Regularly

Change your access tokens periodically to minimize security risks.

​
Troubleshooting

  • Verify the PAT has read:packages scope
  • Check if the token has expired
  • Ensure the username matches the token owner
  • Verify you have access to the repository
  • Check package visibility settings
  • Ensure organization membership for internal packages
  • Private container images are not supported by CybeDefend
  • Change image visibility to Internal or Public to enable scanning
  • Contact your GitHub admin to modify package visibility settings