GitHub Scanner

The GitHub Scanner is a native scanner type that inspects a connected GitHub organization or enterprise, discovering the full inventory of identities such as organization members, teams, and GitHub Apps, along with the secrets it contains across the organizations repositories, including support for GitHub secret scanning across source code and Git history, as well as the relationships between them. Each discovered object is evaluated against Identity and Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 5.1.0 and later.
• A Gateway with Akeyless AI Insights configured.
• A GitHub Target representing the GitHub App that will scan the organization or enterprise.
• The GitHub App used by the Target granted the scope listed under Required GitHub Permissions below.
• Access to configure and run the scanner, granted via:
  1. "Manage ISI Scanners" or "Admin" Gateway Permission.
  2. "Identity & Secrets Intelligence" Administrative Rule set to Scoped or All.
  3. "List" permission on the GitHub Target.

Required GitHub Permissions

The GitHub scanner authenticates with one of the credential types below. in GitHub missing access surfaces as warnings on the scan.

All permissions below are read-only. The scanner never requires write access to your GitHub organization, and never reads secret values, only metadata.

Authentication & Scopes

Audit-log-based features are only available with GitHub Enterprise.

Create a GitHub Scanner

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type GitHub, then click Next.
3. Define a Name for the scanner.
4. Select the Target representing the organization or enterprise to scan, and the Gateway that will execute the scans, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the GitHub scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.