diff --git a/app/controllers/repositories_controller.rb b/app/controllers/repositories_controller.rb
index 24b008d..282219f 100644
--- a/app/controllers/repositories_controller.rb
+++ b/app/controllers/repositories_controller.rb
@@ -85,7 +85,8 @@ class RepositoriesController < ApplicationController
   end
 
   def branches
-    branches_list = Repository.branches(params[:url], params[:scm_type])
+    branch_params = branches_params
+    branches_list = Repository.branches(branch_params[:url], branch_params[:scm_type])
 
     respond_to do |format|
       format.json { render json: branches_list }
@@ -127,6 +128,10 @@ private
     params[:repository]
   end
 
+  def branches_params
+    params.permit(:scm_type, :url)
+  end
+
   # Code extracted from create action
   def create_and_redir(format)
     if @repository.save
--
libgit2 0.21.2