GitHub

Trace connects to GitHub through the Trace GitHub App. You install it on your organization, choose which repositories to grant access to, and they sync into the dashboard ready for testing. This is the primary way to connect source code to Trace.

How it works

1. Install the GitHub App. From the dashboard you'll be guided to install Trace's GitHub App on your organization. GitHub's install screen lists every permission Trace requests before you approve.
2. Select repositories. Grant access to specific repositories, or to all of them. You can change the selection at any time from the app's settings in GitHub.
3. Repositories sync. Granted repositories appear in your dashboard automatically. From there you add metadata and set up the applications you want tested.

What Trace can access

The GitHub App requests read-only access. Trace requests only what's needed to read and clone the repositories you select for testing: no write access to your repository contents, no access to your organization settings, and no access to repositories you haven't explicitly granted. GitHub displays the full permission list at install time, and a complete reference is available on request for security review.

When Trace clones a repository for an engagement, it uses a short-lived GitHub App installation token requested just-in-time. Credentials are never stored in the Git remote URL, and the clone lives in an isolated, ephemeral environment that's destroyed after the engagement. See the Pentest Overview.

Disconnecting

Uninstall the Trace GitHub App, or narrow its repository selection, from your organization's GitHub settings at any time. Trace loses access immediately; removing a repository from the app's selection stops Trace from being able to clone it.

Permissions reference

For the complete list of GitHub App permissions Trace requests, and the reasoning behind each, see Access Control → GitHub App permissions.