GitHub

LiveDeveloper

GitHub connector — read-only, agentless

Works for a personal account or an organization — detected automatically. Scans repository visibility, collaborator access, deploy keys, and installed GitHub Apps and their scopes.

Connect GitHub ← Back to all connectors

What we scan

Repository visibility, collaborator and team access (never source code)
Installed GitHub Apps / OAuth apps and their granted scopes
Deploy keys per repository, including whether each key is read-only

Read-only monitoring — nothing in your GitHub data changes unless you turn on auto-remediation and grant write access separately.

Before you connect

• Personal account: just authorize with your own GitHub login
• Organization: a GitHub Organization Owner to authorize the OAuth app (and an org policy that permits third-party OAuth app access)

Typical first scan: 2–5 minutes

Permissions requested

read:orgOrganizations: list org members, teams, and installed GitHub Apps — never source code — to map who and what can reach which repository. Personal accounts: only used to confirm the account type.
repo (read)Read repository visibility, collaborator lists, and deploy keys (including whether each key is read-only) — on your organization or your own repositories. Never source code.
read:userIdentify the connected account and distinguish members from outside collaborators — the internal/external boundary.
installations inventoryInventory installed GitHub Apps and the permission grants they hold — the "which bot still has admin?" surface (Agent Guard) — for an organization or for your personal account.
manage_billing:copilot (read-only use)Read the Copilot seat inventory — who holds a seat and when it was last used — to flag seats of departed members and seats idle 90+ days. We only ever read; seats are never assigned or removed without an explicit fix action you approve.
read:audit_logRead Copilot-related organization audit-log events (GitHub Enterprise Cloud only) as supporting evidence for Copilot policy findings. Absent on non-Enterprise orgs — the connector degrades gracefully.

Security findings

26 detection rules run on every GitHub scan. Each finding ships with a plain-language explanation, the evidence behind it and remediation steps.

CRITICALPublic exposure
Public link with edit/owner access
CRITICALExternal access
External principal holds ownership
HIGHPublic exposure
Public link share (link-only)
HIGHPublic exposure
Public + web-discoverable share
HIGHExternal access
External access to sensitive data
HIGHExternal access
External collaborator with edit access
HIGHOver permission
Sensitive resource editable org-wide
HIGHOver permission
Broad group access to sensitive data
HIGHAI agent
Service account with broad write access
HIGHAI agent
AI agent with access to sensitive data
HIGHAI agent
AI agent with edit/owner access
HIGHExternal access
Access granted to a look-alike (typosquat) domain
HIGHStale access
Copilot seat assigned to a departed member
HIGHOver permission
Installed GitHub App holds write or admin permissions
HIGHOver permission
Deploy key with write access
MEDIUMOver permission
Broad org-wide edit access (aggregate)
MEDIUMOver permission
Resource with multiple owners
MEDIUMStale access
Stale external read access
MEDIUMStale access
Dormant privileged internal account
MEDIUMMisconfig
Direct share breaks folder inheritance
MEDIUMMisconfig
GitHub Copilot allows suggestions that match public code
MEDIUMStale access
Copilot seat unused for 90+ days
MEDIUMStale access
Write-capable GitHub App looks abandoned
MEDIUMExternal access
Public repository has collaborators with write access
MEDIUMMisconfig
Vendor AI-training data-contribution posture
LOWMisconfig
Copilot seats auto-assigned to all members

What we scan

Security findings

Related guide

How to connect GitHub