FAQ
Account
Section titled “Account”Can I use my Gmail? No. Sign-up accepts only work emails.
Is the authenticator code required? Yes, on every sign-in. In the Workspace it is asked again on every entry.
Security Gate
Section titled “Security Gate”What scopes does the token need?
None: the LEAVORY_TOKEN has no scopes. It only downloads the date database and gives no access to your account,
Azure DevOps or the registry. See Create the token for the
minimum permissions of whoever stores the token in Azure DevOps.
Does Leavory receive my report or my code? No. The step sends only the token, to get the database download link. The comparison happens on your agent.
Do the Workspace Exposure Age tab and the pipeline use the same rule? The same logic, with limits set in different places. In the tab, the limits live in your browser and are for review. In the pipeline, the template parameters apply.
Why is the number in the tab different from the pipeline log? The tab shows one row per pipeline that found the vulnerability and may be looking at another branch (Data from filter). The log shows only that build.
Why does a vulnerability show as “No date”? None of the four sources has the date, or the ID is neither a CVE nor a GHSA. It happens with advisories published a few hours ago. These never fail the build.
If Leavory goes down, does my pipeline stop? No. If the database can’t be downloaded, the step warns and the build continues.
I want to accept the risk of a specific vulnerability.
Today, through the repository’s .trivyignore: it stops being reported and the Security Gate doesn’t see it either.
Use it carefully, because it stays ignored until it’s removed from the file.
Does it work outside Azure DevOps? The generated template is for Azure DevOps. For other CI tools, contact support.
Workspace
Section titled “Workspace”What permissions does the Workspace need in Azure DevOps? A PAT with five scopes, all read-only: Project and Team, Code, Build, Graph and Service Connections. See Connect Azure DevOps.
Does the Workspace work with GitHub? Yes. A tenant can connect Azure DevOps, GitHub or both, and everything lands on the same screens. GitHub uses a fine-grained token with read-only permissions: Metadata, Contents, Actions, Administration and Members. See Connect GitHub.
Does Leavory change anything in my Azure DevOps or GitHub? No. Every call is a read.
Image Scan
Section titled “Image Scan”How long can I use it? No time limit. On the free plan the limit is 5 images per account; to raise it, talk to our sales team.
Do I need to grant write permission on the registry? No. Use a dedicated, read-only (pull) credential limited to the scanned repositories. The step-by-step for each registry is in Registry credentials.