> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Integration

> Connect your GitHub repositories to CodeThreat

Connect your GitHub account to scan repositories for security vulnerabilities.

## Connection Methods

<Tabs>
  <Tab title="GitHub App (Recommended)">
    **Best for**: Organizations and teams

    * Fine-grained repository access
    * Higher API rate limits
    * Better security with organization-level installation
    * Easier permission management

    **Requirements**: Organization admin to install app
  </Tab>

  <Tab title="OAuth">
    **Best for**: Individual developers

    * Fastest setup (one-click authorization)
    * Automatic token refresh
    * Good for personal accounts

    **Requirements**: GitHub account access
  </Tab>

  <Tab title="Personal Access Token">
    **Best for**: Automation, CI/CD pipelines

    * Fine-grained permission control
    * Good for scripting and automation
    * No OAuth redirect needed

    **Requirements**: GitHub account with token creation ability
  </Tab>
</Tabs>

***

## GitHub App Setup

<Steps>
  <Step title="Navigate to Integrations">
    **Settings** → **Integrations** → **GitHub**
  </Step>

  <Step title="Choose GitHub App">
    Click **Connect with GitHub App**
  </Step>

  <Step title="Select Installation Target">
    Choose personal account or organization
  </Step>

  <Step title="Select Repositories">
    Choose all repositories or specific repos
  </Step>

  <Step title="Install & Authorize">
    Click **Install & Authorize**
  </Step>

  <Step title="Import Repositories">
    Select repositories to import for scanning
  </Step>
</Steps>

### GitHub App Permissions

| Permission          | Access Level | Why We Need It                       |
| ------------------- | ------------ | ------------------------------------ |
| Repository contents | Read         | To scan code for vulnerabilities     |
| Pull requests       | Read & Write | To scan PRs and post review comments |
| Checks              | Write        | To show pass/fail status on PRs      |
| Webhooks            | Read & Write | To receive push and PR notifications |

<Warning>
  CodeThreat never pushes commits or modifies repository files, even though "Write" access is granted for PR comments and checks.
</Warning>

***

## OAuth Setup

<Steps>
  <Step title="Start OAuth Flow">
    **Settings** → **Integrations** → **GitHub** → **Connect with OAuth**
  </Step>

  <Step title="Authorize CodeThreat">
    Review permissions and click **Authorize CodeThreat**
  </Step>

  <Step title="Grant Organization Access">
    Grant access to organizations if applicable
  </Step>

  <Step title="Import Repositories">
    Select repositories to scan
  </Step>
</Steps>

***

## Personal Access Token Setup

<Steps>
  <Step title="Create Token">
    GitHub → **Settings** → **Developer settings** → **Personal access tokens** → **Generate new token (classic)**
  </Step>

  <Step title="Configure Token">
    Set note: `CodeThreat Security Scanner`

    Select scopes:

    * ✅ `repo` (Full control of private repositories)
    * ✅ `read:org` (Read org membership)
    * ✅ `admin:repo_hook` (Full control of webhooks)
  </Step>

  <Step title="Generate and Copy">
    Click **Generate token** and copy immediately
  </Step>

  <Step title="Add to CodeThreat">
    **Settings** → **Integrations** → **GitHub** → **Connect with Token**

    Paste token and click **Connect**
  </Step>
</Steps>

***

## Webhook Configuration

CodeThreat automatically creates webhooks for selected repositories:

* **Push events**: Trigger scans on code changes
* **Pull request events**: Scan PRs automatically
* **Workflow events**: Detect CI/CD changes

Webhook URL: `https://app.codethreat.com/webhooks/github`

***

## Troubleshooting

### Webhook Not Receiving Events

* Verify webhook URL is correct
* Check webhook is active in GitHub settings
* Ensure repository has webhook configured
* Check firewall allows GitHub webhooks

### Rate Limit Issues

* Use GitHub App for higher rate limits (15,000/hour vs 5,000/hour)
* Reduce scan frequency for large repositories
* Contact support for enterprise rate limits

### Permission Errors

* Verify token has correct scopes
* Check organization OAuth app policy
* Ensure repository access is granted

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Automated Scanning" icon="repeat" href="/scanning/automated-scanning">
    Configure automatic scans
  </Card>

  <Card title="PR Scanning" icon="code-pull-request" href="/scanning/pr-scanning">
    Set up PR security reviews
  </Card>
</CardGroup>