Connecting GitHub
Installing the GitHub App turns on the source, dependency and infrastructure rules, pull request checks and Fix with AI.
The GitHub App is installed once on the repositories you choose, then connected to a site. Everything that reads code - 52 source rules, 38 infrastructure rules, dependency advisories, invariants, pull request checks and Fix with AI - depends on this step.
- 1Install the App
From Repositories → Connect GitHub. Choose the repositories you want read; you can change the selection later on GitHub.
- 2Connect a repository to a site
A repository belongs to a site, which is how code findings and runtime findings end up on the same screen.
- 3Wait for the inventory scan
The first scan reads the tree, the lockfiles, the deploy files and a bounded slice of git history. It establishes the baseline everything later is compared against.
- 4Open a pull request
The next pull request gets a check with NEW and UNCHANGED verdicts against its base branch.
What the App can do
| Permission | Why |
|---|---|
| Read code and metadata | Analysis. Source is read, analyzed and discarded; findings, facts and paths are kept. |
| Read pull requests | To compare a branch against its base and mark findings NEW or UNCHANGED. |
| Write check runs | To post the verdict where your team already reviews code. |
| Write contents on a branch | Only when you ask for Fix with AI, and only on a new branch opened as a draft pull request. |
Uninstall the App on GitHub whenever you like. AppScan notices the installation is gone, stops scanning, and keeps the findings it already produced.
Questions
Do you store my source code?
No. Source is fetched for analysis and discarded afterwards. What is kept is findings, facts, file paths and short masked snippets around a finding.
Do you support GitLab or Bitbucket?
Not today. GitHub is the only code host with an integration. The runtime half of the product works regardless of where your code lives.
How many repositories can I connect?
Three per site on Pro, Studio and Agency; five per site on Team. Free plans cannot connect a repository at all.
Will AppScan push to my default branch?
Never. The only write is a new branch opened as a draft pull request, and only when a person clicks Fix with AI.
Something here wrong, missing or out of date? Tell us and we will fix the page.