GitHub Integration Setup Guide

This guide walks you through connecting your GitHub repositories to SecureStack for comprehensive code security scanning, including SAST, SCA, and secrets detection.

Quick Start

The fastest way to get started is with a Personal Access Token (PAT). For organizations needing more granular control, we recommend GitHub Apps.

Option 1: Personal Access Token (Recommended for Individuals)

Personal Access Tokens are the simplest way to grant SecureStack access to your repositories. They work for both personal and organization repositories.

Step-by-Step Instructions

1. Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
2. Click "Generate new token (classic)"
3. Enter a descriptive note: SecureStack Security Assessment
4. Set an expiration period (we recommend 90 days for security)
5. Select the required scopes:
   • repo — Full control of private repositories (required for private repos)
   • public_repo — Access public repositories only (for public repos)
   • read:org — Read organization membership (optional, for org repos)
6. Click "Generate token"
7. Important: Copy the token immediately — you won't be able to see it again!
8. Paste the token into SecureStack during the onboarding process

Option 2: GitHub App (Recommended for Organizations)

GitHub Apps provide more granular permissions and better audit trails. They're ideal for organizations that need to manage access across multiple repositories.

Step-by-Step Instructions

1. Go to your Organization Settings → Developer settings → GitHub Apps
2. Click "New GitHub App"
3. Fill in the app details:
   • App name: SecureStack Security Scanner
   • Homepage URL: https://securestackscan.com
   • Callback URL: https://api.securestackscan.com/auth/github/callback
4. Configure permissions:
   • Contents: Read-only (to access repository files)
   • Metadata: Read-only (basic repository information)
   • Pull requests: Read-only (to analyze PR changes)
   • Security events: Read-only (access security advisories)
   • Vulnerability alerts: Read-only (Dependabot alerts)
5. Click "Create GitHub App"
6. Install the app on your organization by clicking "Install App"
7. Select the repositories you want to grant access to
8. Share the installation ID with SecureStack support

What SecureStack Scans

Once connected, SecureStack performs read-only analysis of your repositories for:

• Static Application Security Testing (SAST): Identifies code vulnerabilities and security issues in your source code
• Software Composition Analysis (SCA): Scans third-party dependencies for known vulnerabilities (CVEs)
• Secrets Detection: Finds hardcoded credentials, API keys, and sensitive data accidentally committed to version control
• Infrastructure as Code (IaC): Analyzes Terraform, CloudFormation, and Kubernetes configurations for misconfigurations
• CI/CD Security: Reviews GitHub Actions workflows and deployment pipelines for security issues

Testing Your Token

Before using your token in SecureStack, you can verify it works by running this command in your terminal:

curl -H "Authorization: token YOUR_TOKEN_HERE" \ https://api.github.com/user

If successful, you'll see your GitHub user information in JSON format.

Security Best Practices

• Use tokens with the minimum required permissions
• Set appropriate expiration dates (90 days recommended)
• Regularly rotate tokens according to your security policy
• Monitor token usage in your GitHub audit logs
• Revoke tokens immediately after assessments if they're temporary
• Consider using GitHub Apps for organization-wide deployments

Troubleshooting

"Bad credentials" error

This usually means the token has expired or been revoked. Generate a new token and try again.

"Resource not accessible" error

The token doesn't have sufficient permissions. Ensure you've selected the reposcope for private repositories.

Can't see organization repositories

You may need to authorize the token for SSO. Go to your token settings and click"Configure SSO" next to your organization.