diff --git a/config.example.scfg b/config.example.scfg
index 0c27591435696f433122fed28814153e6e6edceb..5c3e5e4ff8452643ed462be5a8d494f9c4499d18 100644
--- a/config.example.scfg
+++ b/config.example.scfg
@@ -7,9 +7,15 @@ passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
 aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
 syntax-highlight monokailight
 
+
+scan /srv/git/private {
+    public false
+}
+
 scan /srv/git/ {
     public true
 }
+
 
 repository /srv/git/cerrado.git {
     name cerrado
diff --git a/pkg/config/config.go b/pkg/config/config.go
index c17e6df4ca913f882912747f4e76aa240976a158..1ad5108b7b9319683627faa0e89059686d9b0a10 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -30,7 +30,7 @@
 	// configuration represents file configuration.
 	// fields needs to be exported to cmp to work
 	configuration struct {
-		Scan            *scan
+		Scans           []*scan
 		RootReadme      string
 		ListenAddr      string
 		Passphrase      string
@@ -82,10 +82,12 @@ 		rootReadme:      config.RootReadme,
 		syntaxHighlight: config.SyntaxHighlight,
 	}
 
-	if config.Scan.Path != "" {
-		err = repo.expandOnScanPath(config.Scan.Path, config.Scan.Public)
-		if err != nil {
-			return nil, err
+	for _, scan := range config.Scans {
+		if scan.Path != "" {
+			err = repo.expandOnScanPath(scan.Path, scan.Public)
+			if err != nil {
+				return nil, err
+			}
 		}
 	}
 
@@ -179,7 +181,7 @@ 	}
 
 	config := defaultConfiguration()
 
-	err = setScan(block, config.Scan)
+	err = setScan(block, &config.Scans)
 	if err != nil {
 		return nil, err
 	}
@@ -269,18 +271,15 @@ }
 
 func defaultConfiguration() *configuration {
 	return &configuration{
-		Scan:         defaultScan(),
+		Scans:        defaultScans(),
 		RootReadme:   "",
 		ListenAddr:   defaultAddr(),
 		Repositories: make([]*GitRepositoryConfiguration, 0),
 	}
 }
 
-func defaultScan() *scan {
-	return &scan{
-		Public: false,
-		Path:   "",
-	}
+func defaultScans() []*scan {
+	return []*scan{}
 }
 
 func defaultAddr() string {
@@ -322,18 +321,27 @@ 	scanDir := block.Get("listen-addr")
 	return setString(scanDir, listenAddr)
 }
 
-func setScan(block scfg.Block, scan *scan) error {
-	scanDir := block.Get("scan")
-	if scanDir == nil {
-		return nil
-	}
-	err := setString(scanDir, &scan.Path)
-	if err != nil {
-		return err
+func setScan(block scfg.Block, scans *[]*scan) error {
+	for _, scanDir := range block.GetAll("scan") {
+		s := &scan{}
+		if scanDir == nil {
+			return nil
+		}
+		err := setString(scanDir, &s.Path)
+		if err != nil {
+			return err
+		}
+
+		public := scanDir.Children.Get("public")
+		err = setBool(public, &s.Public)
+		if err != nil {
+			return err
+		}
+
+		*scans = append(*scans, s)
 	}
 
-	public := scanDir.Children.Get("public")
-	return setBool(public, &scan.Public)
+	return nil
 }
 
 func setBool(dir *scfg.Directive, field *bool) error {
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 9080351a01193f3637fe3a501fb5c6b4b967a379..cc58ce966db251429c66f6fa18baaa4eda2b339f 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -18,9 +18,11 @@ 		{
 			name:   "minimal scan",
 			config: `scan "/srv/git"`,
 			expectedConfig: &configuration{
-				Scan: &scan{
-					Public: false,
-					Path:   "/srv/git",
+				Scans: []*scan{
+					{
+						Public: false,
+						Path:   "/srv/git",
+					},
 				},
 				ListenAddr:   defaultAddr(),
 				Repositories: []*GitRepositoryConfiguration{},
@@ -33,9 +35,11 @@ scan "/srv/git" {
 	public true
 }`,
 			expectedConfig: &configuration{
-				Scan: &scan{
-					Public: true,
-					Path:   "/srv/git",
+				Scans: []*scan{
+					{
+						Public: true,
+						Path:   "/srv/git",
+					},
 				},
 				ListenAddr:   defaultAddr(),
 				Repositories: []*GitRepositoryConfiguration{},
@@ -45,7 +49,7 @@ 		{
 			name:   "minimal repository",
 			config: `repository /srv/git/cerrado.git`,
 			expectedConfig: &configuration{
-				Scan:       defaultScan(),
+				Scans:      defaultScans(),
 				ListenAddr: defaultAddr(),
 				Repositories: []*GitRepositoryConfiguration{
 					{
@@ -68,7 +72,7 @@ 	public true
 	about readme.txt
 }`,
 			expectedConfig: &configuration{
-				Scan:       defaultScan(),
+				Scans:      defaultScans(),
 				ListenAddr: defaultAddr(),
 				Repositories: []*GitRepositoryConfiguration{
 					{
@@ -85,7 +89,7 @@ 		{
 			name:   "minimal listen",
 			config: ``,
 			expectedConfig: &configuration{
-				Scan:         defaultScan(),
+				Scans:        defaultScans(),
 				ListenAddr:   defaultAddr(),
 				Repositories: []*GitRepositoryConfiguration{},
 			},
@@ -94,7 +98,7 @@ 		{
 			name:   "complete listen",
 			config: `listen-addr unix://var/run/cerrado/cerrado.sock`,
 			expectedConfig: &configuration{
-				Scan:         defaultScan(),
+				Scans:        defaultScans(),
 				ListenAddr:   "unix://var/run/cerrado/cerrado.sock",
 				Repositories: []*GitRepositoryConfiguration{},
 			},
@@ -120,9 +124,11 @@ 	public true
 	about readme.txt
 }`,
 			expectedConfig: &configuration{
-				Scan: &scan{
-					Public: true,
-					Path:   "/srv/git",
+				Scans: []*scan{
+					{
+						Public: true,
+						Path:   "/srv/git",
+					},
 				},
 				ListenAddr:      "unix://var/run/cerrado/cerrado.sock",
 				Passphrase:      "$2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq",