Use GitHub for connected repositories. This is the preferred SaaS mode because the worker can clone or fetch the source consistently in staging and production.
Use local folder or ZIP upload when the repository exists only on your machine. The browser creates an immutable upload snapshot; the server never receives direct filesystem access.
Server and network mounts
Advanced users can scan mounted Linux paths visible to both the API and worker containers. Windows paths such as D:\Git\customer-app -> /mnt/d/Git/customer-app are not scanned directly until mounted on the ho-BPMN host. Then bind that Linux path into both API and worker as /workspace/sources/customer-app. Use Browser upload for a one-time Windows workstation snapshot when you cannot create that host/container mount. Raw UNC shares need the same Linux host mount and container bind path before scanning.
Use the customer agent when source must stay inside a customer network. Create an agent project, register the agent, submit a signed manifest, create an upload session, upload the ZIP snapshot, then start the run after source preflight shows the latest snapshot is ready.