Connect GitHub
FlawPilot scans the source in your GitHub.com or GitHub Enterprise repositories, alongside the live-site scan. Connect once, choose what to track, and each scan reports insecure code, exposed secrets and vulnerable dependencies.
OAuth or a Personal Access Token
Before you start
- A FlawPilot account - the free tier is enough to connect a repository and run a scan.
- A GitHub account with access to the repositories you want scanned.
- For an organisation repo, an owner may need to approve the OAuth grant. A Personal Access Token works where org policy blocks OAuth.
How to connect
Connect your account
From Integrations in the FlawPilot portal, choose GitHub and connect with OAuth or a Personal Access Token. You can connect more than one GitHub account.
Pick repositories to track
In the repository picker, select the repos you actually want FlawPilot to know about. Everything else the grant can see stays out of view.
Assign a project and branch
For each tracked repo, assign a project and choose a branch from a searchable picker (the current branch is pinned first). Scans run against whichever branch is set here.
Run a code scan
With a project and branch assigned, the repo is scannable. Each scan reports insecure code, exposed secrets and vulnerable dependencies, scored independently.
Good to know
- OAuth is the fastest way in; a Personal Access Token works where OAuth is restricted by an org policy.
- Both GitHub.com and GitHub Enterprise are supported.
- A repo becomes scannable only once it has a project and a branch assigned.
- If a credential goes invalid, expires, or is revoked, the connection shows “Reconnect needed” immediately, along with the failure reason.
- Visibility (public/private) and last-synced time are shown per tracked repo.
Once it is connected
A good first run, so you know the pipeline works before you add every repo.
- Connect one small repo first and run a scan end to end before adding the rest.
- Point the branch at whatever you actually ship from - usually main, not a long-lived feature branch.
- Re-run after a fix lands to confirm the finding clears.
If something does not work
The repository picker is empty
The grant has no access to any repos yet. On GitHub, check the FlawPilot app's repository access under Settings - Applications, and add the repos you want visible.
An organisation repo does not appear
Org-owned repositories need an owner to approve the OAuth grant. Until then only your personal repos are listed. A Personal Access Token with the right scopes is the alternative.
The connection says “Reconnect needed”
The credential expired or was revoked. Reconnect from Integrations - the card shows the failure reason so you can tell an expiry from a revocation.
A repo is connected but will not scan
It needs both a project and a branch assigned. Until both are set the repo is tracked but not scannable.
Connect another provider
GitHub, GitLab and Bitbucket can all be connected side by side, and each can hold more than one account.
See all integrations