GitHub

Trace connects to GitHub through the Trace GitHub App. You install it on your organization, choose which repositories to grant access to, and they sync into the dashboard ready for testing. This is the primary way to connect source code to Trace.

How it works

1. Install the GitHub App. From the dashboard you'll be guided to install Trace's GitHub App on your organization. GitHub's install screen lists every permission Trace requests before you approve.
2. Select repositories. Grant access to specific repositories, or to all of them. You can change the selection at any time from the app's settings in GitHub.
3. Repositories sync. Granted repositories appear in your dashboard automatically. From there you add metadata and set up the applications you want tested.

Choosing which repositories Trace scans

The Repositories table on the integration page lists every synced repository. Use the filter box to narrow it by name. Each row has an Included switch: turn it off to prevent new scheduled, push, pull request, and manual scans, including pentest sessions that use its source. Scans and sessions already created can finish. Turn it back on to allow new scans. To change several at once, tick the rows (or the header checkbox to select everything shown) and choose Include in scanning or Exclude from scanning from the bar that appears. Excluding a repository doesn't remove it or its history; re-syncing from the provider leaves your choice in place. Admins and analysts can change this; other members see the current state.

What Trace can access

The GitHub App requests read-only access. Trace requests only what's needed to read and clone the repositories you select for testing: no write access to your repository contents, no access to your organization settings, and no access to repositories you haven't explicitly granted. GitHub displays the full permission list at install time, and a complete reference is available on request for security review.

When Trace clones a repository for an engagement, it uses a short-lived GitHub App installation token requested just-in-time. Credentials are never stored in the Git remote URL, and the clone lives in an isolated, ephemeral environment that's destroyed after the engagement. See the Pentest overview.

Disconnecting

Uninstall the Trace GitHub App, or narrow its repository selection, from your organization's GitHub settings at any time. Trace loses access immediately; removing a repository from the app's selection stops Trace from being able to clone it.

Permissions reference

For the complete list of GitHub App permissions Trace requests, and the reasoning behind each, see Access control → GitHub App permissions.