Skip to main content
The GitHub integration gives NoScope access to the repositories you choose. The agent uses the code for white-box testing. This integration does not create issues. To send findings to an issue tracker, use Jira or GitLab issues.

​
Before you start

  • You need to be able to install GitHub Apps on your GitHub organization, or ask an owner of the organization to approve the install.
  • Decide which repositories NoScope should see. You can give access to all repositories or only to selected ones.

​
Connect GitHub

1

Open Integrations

Open the Integrations page in NoScope and find the GitHub card.
2

Install the NoScope app

Click Connect. GitHub opens and asks you to install the NoScope app. Pick your GitHub organization.
3

Choose repositories

Choose Only select repositories and pick the repositories NoScope may read. This is the safest choice. You can change this list later in your GitHub organization settings.
4

Return to NoScope

After you approve, GitHub sends you back to NoScope. The GitHub card shows Connected.
To see which repositories NoScope can access, click View connected repositories on the GitHub card.

​
Use repositories in a pentest

Connecting GitHub does not start a white-box scan by itself. You also need to select repositories for each application in the Target & scope step. See Connect source code.

​
How NoScope uses your code

  • The agent copies the selected repositories at the start of each scan, from the default branch.
  • NoScope does not keep a copy of your code after the scan.
  • NoScope does not push commits, open pull requests, or create GitHub issues.

​
Disconnect

Click Disconnect on the GitHub card, then confirm in the Disconnect GitHub? dialog. New scans stop using source code, and the application page shows that source code scanning is unavailable. Findings from earlier scans stay in NoScope. To fully remove access, also uninstall the NoScope app in your GitHub organization settings.