Findings come inCode, secrets & dependencies
GitHub Advanced Security
Brings code scanning alerts, secret scanning alerts and Dependabot findings out of per-repository tabs and into one estate-wide list ordered by what is actually exploitable.
What the connector does
- Code scanning, secret scanning and Dependabot alerts across the repositories you name
- Alerts attached to the repository asset and rolled up to the application it belongs to
- CodeQL rule identifiers mapped to CWE for correlation with other sources
- Works against github.com and GitHub Enterprise Server
Credential required
A fine-grained token with read access to security alerts on the repositories you name. Nothing is written.
What this connector is for
GitHub shows alerts per repository. An organisation with two hundred repositories therefore has two hundred views of its own risk and no answer to "what should we fix first". This connector produces that answer by putting every alert into one table alongside everything the rest of the estate reports.
What is ingested
Open code scanning alerts, open secret scanning alerts and Dependabot alerts. Secret scanning results are handled with the care they need: the platform records that a secret of a given type was found at a given location and never stores the secret itself.
What happens next
Each alert becomes a finding against the repository. Ownership comes from the repository's CODEOWNERS file and its recent commit history, so the finding reaches the team that actually maintains the code rather than a security mailbox. When the same dependency vulnerability also arrives from Snyk or a container scan, the three become one finding with three sources.
What you have to grant
A read-only, fine-grained token scoped to the repositories you name. Opening a draft fix pull request is a separate feature behind a separate credential, granted deliberately — this connector cannot push a branch even if it wanted to, because the client it uses has no method that writes.