GitHub Scanner

The GitHub Scanner is a native scanner type that inspects a connected GitHub organization or enterprise, discovering the full inventory of identities such as organization members, teams, and GitHub Apps, along with the secrets it contains across the organization's repositories, including support for GitHub secret scanning across source code and Git history, as well as the relationships between them. Each discovered object is evaluated against Identity & Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

What the GitHub Scanner Discovers

Each scanner covers one or more object types, selected when the scanner is created:

Each scanner covers the GitHub organization its GitHub App is installed in, and only the repositories the App installation can access. To scan only some of those repositories, filter them when you create the scanner, as described in Create a GitHub Scanner. The App must be installed only on that organization, otherwise the scan fails. To scan more organizations, create a GitHub App, a Target, and a scanner for each organization.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 5.1.0 and later.Scanning the Code object type requires version 5.3.0 and later.
• A Gateway with Akeyless AI Insights configured.
• A GitHub Target representing the GitHub App that will scan the organization.
• The GitHub App used by the Target granted the permissions listed under Required GitHub Permissions below.
• Access to configure and run the scanner, granted via:
  • Manage ISI Scanners or Admin Gateway Permission.
  • Identity & Secrets Intelligence Administrative Rule set to Scoped or All.
  • List permission on the GitHub Target.

Required GitHub Permissions

The GitHub scanner authenticates with one of the credential types below. in GitHub missing access surfaces as warnings on the scan.

All permissions below are read-only. The scanner never requires write access to your GitHub organization, and never reads secret values, only metadata.

Authentication & Scopes

Audit-log-based features are only available with GitHub Enterprise.

Create a GitHub Scanner

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type GitHub, then click Next.
3. Define a Name for the scanner.
4. Select the Gateway that will execute the scans, and the Target representing the organization or enterprise to scan, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the GitHub scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.

Required GitHub Permissions

The GitHub App used by the Target needs read access to the GitHub resources behind each object type selected on the scanner. Every table in this section has an Object Type column, so you can grant only what the selected object types need. Personal access tokens are not supported.

Quick Setup

For each object type selected on the scanner, grant the GitHub App the permissions listed below:

Granular Permissions

All permissions below are read-only, except Codespaces secrets. The scanner never changes your GitHub organization, and never reads the values of Actions, Dependabot, or Codespaces secrets, only their metadata.

Required Permissions

The permissions listed below are required for each object type to return results. If one is missing, the scan still completes, and the gap is reported as a warning in the scan details:

A missing permission never fails the scan. Any other failure in a selected object type, or invalid GitHub App credentials, marks the whole scan as failed.

Additional Permissions for Complete Coverage

These permissions are optional. If missing, the scan still completes, but with reduced visibility, and the policies that depend on them are not evaluated.

Each gap is reported as a warning in the scan details.

Create a GitHub Scanner

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type GitHub, then click Next.
3. Define a Name for the scanner.
4. Select the Gateway that will execute the scans, and the Target representing the GitHub App installed on the organization to scan, then click Next.
5. Use the Object Type drop-down list to select the object types to scan.
6. Optionally, to filter the repositories to scan, set the Scanner Scope to Repository, and select a filter in Select Repositories By: Name, Topic, Custom Properties, Regex, or None . Click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the GitHub scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.