Enumerate repositories from four independent sources: the source host, the CI system, the package and image registries, and what is deployed. Compare the four lists. A repository that appears in one source and not the others is where an inventory gap usually starts.
Why the seller's list is incomplete
The seller's list is whatever someone remembers. Teams change, tools get abandoned, and scripts live in personal accounts. Nobody lies, the list just ages.
The four sources
| Source | What it shows | Blind spot |
|---|---|---|
| Source host (organization view) | Every repository in the organization, including archived | Repos in personal or other accounts |
| CI system | Repositories that have pipelines | Repos with no automation |
| Registries (packages and images) | What was actually published | Private artifacts built elsewhere |
| Deployed workloads | What runs in production | Anything built long ago and never redeployed from source |
Steps
- Ask for read access to the organization on the source host and export the full repository list with last commit date and archived flag.
- Export pipeline definitions and note which repositories they build.
- List package and image names in each registry and map them back to repositories.
- List running workloads and the image each uses.
- Join the lists by name. Mark each repository as seen in one, two, three or four sources.
Reading the result
- Seen in all four: the normal case. Check it has an inventory.
- Seen in registries and workloads but not on the source host: the source may be elsewhere or lost. High priority.
- Seen on the source host only, no commits for years: probably dead. Confirm and archive.
- Seen in CI only: a build with no clear product. Ask what it produces.
Edge cases
Forks of open source projects sit in the same list as original work. Mark them separately, since a fork carries upstream code plus local changes. Personal accounts are a known gap: ask whether any employee or contractor published company code outside the organization and how that is handled.
What to record
For each repository: owner, language and package manager, whether it ships or runs, last deployment, and whether an inventory exists. This table becomes the coverage baseline for the rest of the review, and the denominator for a statement like "we have inventories for 40 of 55 repositories."
Safeguard's asset discovery is built for finding what is in an estate that nobody listed, and the SBOM and dependency scanning then cover each repository found. A free scan is at gold.safeguard.sh/scan.
Quick check
Should archived repositories be included?
List them, but mark them archived. Confirm nothing still deployed depends on them.
What if the target will not give organization level access?
Ask for an exported list produced by their admin, with dates, and spot check by asking for a few specific repositories you found through registries.
Last reviewed: 19 October 2026.
