GitHub Connection

Connect GitHub to enable white box pentesting with SAST, SCA, and secret detection.

Two connection methods

GitHub App (recommended)

The TurboPentest GitHub App provides fine-grained repository access.

1. Go to Dashboard > Account > GitHub
2. Click Install GitHub App
3. Select the repositories you want to grant access to
4. You are redirected back to TurboPentest

Benefits:

• Per-repository access control
• No personal token exposure
• Automatic token refresh

OAuth

OAuth grants access to all repositories your GitHub account can see.

1. Go to Dashboard > Account > GitHub
2. Click Connect with GitHub
3. Authorize TurboPentest

When to use: If you cannot install GitHub Apps on your organization, or for quick personal repository testing.

Using GitHub with pentests

Once connected, include the repoUrl in your pentest request:

curl -X POST https://turbopentest.com/api/pentests \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "https://app.example.com",
    "repoUrl": "https://github.com/your-org/your-repo"
  }'

This enables Code Scanner (SAST), Dep Scanner (SCA), and Secret Scanner (secret detection) in addition to all black box tools.

Create GitHub issues from findings

The same GitHub connection can also file an issue for each finding when a pentest completes - no second credential to store.

1. Go to Dashboard > Account > Notifications (the Integrations tab links here too)
2. Enable GitHub Issues and choose a ticket style and minimum severity
3. By default, issues go to the pentest's connected repo; you can point them at an explicit owner/repo instead

Each issue is created with the turbopentest label plus a severity label, and includes the finding title, severity, proof of exploit, remediation, and a link back to the full report. Choose one issue per finding or a single summary issue, and set a minimum severity threshold so only findings at or above a chosen severity are filed.

Note: Issue creation requires the GitHub connection to carry issues: write. GitHub Apps request this scope during install; for a PAT, grant the issues (or repo) scope.

Managing connections

View and manage your GitHub connections in Dashboard > Account > GitHub. You can:

• See which repositories are accessible
• Disconnect a connection
• Switch between OAuth and GitHub App