// DOCUMENTATION
GitHub integration.
Veyra connects to GitHub through a GitHub App installed on the specific repositories you select, using short-lived read-only tokens.
Installing the app
- From your Veyra dashboard, open Integrations → GitHub and select Connect.
- GitHub asks which account or organization to install into. You must be an organization owner, or have the ability to approve app installations.
- Choose Only select repositories and pick the repositories in scope. Veyra recommends against "All repositories" — grant the minimum that covers the applications you are assessing.
- Review the requested permissions (below) and approve.
- Return to Veyra. The selected repositories appear within a few seconds and can be assigned to applications.
Selecting repositories later
You can add or remove repositories from the installation at any time in GitHub, under Settings → Applications → Veyra → Configure. Removing a repository stops analysis of it immediately; existing findings remain until you delete them.
Permissions requested
Veyra requests the minimum permissions its analysis requires, and no write permission of any kind.
| Permission | Access | Why |
|---|---|---|
| Contents | Read | Retrieve source for analysis, including history for secret detection. |
| Metadata | Read | Mandatory for all GitHub Apps. Repository names, default branch, languages. |
| Pull requests | Read | Only if pull-request analysis is enabled on your plan. |
| Security events | Read | Optional. Correlate existing Dependabot and code-scanning alerts so you are not triaging the same issue twice. |
| Webhooks | Receive | Push events, so change-triggered reassessment can run on Growth and Advanced plans. |
No write access, ever
Veyra cannot push commits, open or merge pull requests, change settings, or delete anything. This is enforced by the App’s permission set, not by internal policy — GitHub itself will reject a write attempt.
How tokens are handled
- Veyra requests a short-lived installation access token at the start of each assessment. Tokens are scoped to your installation and expire automatically.
- No long-lived personal access token is requested, stored, or accepted.
- Tokens are held in a managed secrets store and injected into the ephemeral analysis environment at run time.
- When the analysis environment is destroyed, the token goes with it.
What Veyra reads
For each selected repository: the source tree on monitored branches, dependency manifests and lockfiles, configuration and infrastructure-as-code files, and commit history for secret detection. Veyra does not read repositories outside the installation, and cannot see repositories you did not select.
Revoking access
Two routes, both immediate:
- In Veyra: Integrations → GitHub → Disconnect. Stops all analysis and discards stored installation references.
- In GitHub: Settings → Applications → Installed GitHub Apps → Veyra → Uninstall. This works whether or not you can reach the Veyra dashboard, and does not require notifying us.
Any assessment in progress fails closed. To also remove the findings already produced, request deletion — see Data retention.
Other providers
GitHub is supported today. GitLab and Bitbucket are planned. Self-hosted Git is not currently supported. If your code lives elsewhere, tell us — we prioritize by what customers actually use, and we will be straight with you about timing rather than implying it is imminent.