Twelve hosting providers

Each connection carries its own address, credential, scope and sensitivity labels. An estate that grew by acquisition is usually on three different hosts, and this is the case the product was built around.

The two most common answers to "we host our own git", and neither Snyk nor Semgrep connects to either of them. A token made under Settings, Applications reaches everything its account can see, so one connection usually covers a whole instance rather than one per organization the way a fine grained GitHub token does. Forgejo is a fork of Gitea and speaks the same API, so one implementation serves both, and the two names are kept apart everywhere a person reads one: somebody running Forgejo should not be told they are running Gitea.

Every host spells a link to a file differently and Gitea has no /blob/ route at all, so a GitHub shaped link there is a 404 rather than a redirect. Each host now says once where it puts a file, a commit and a blame, and every finding is written with the path that host actually serves. Where a host has no equivalent page, the finding carries no link rather than one that goes nowhere.

Dependabot alerts, code scanning and organization membership are asked for only where the host has them. Claiming a feature would mean calling for it, getting nothing, and reading that as good news. Gitea and Forgejo have a member listing with no role filter, so asking it for the administrators returns everybody: that one is left unwired rather than shipped as a report saying the whole organization owns it.

Neither is git, so there is no history for the credential engines to walk. Everything that reads files works: the code analysis, the dependencies, the licenses, the triage. What is missing is the credential deleted three years ago, and the connection form says so before anybody sets one up.

Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.