---
title: "GitHub Connection"
description: "Connect your GitHub repositories to enable white-box pentesting with Code Scanner SAST, Dep Scanner SCA, and Secret Scanner secret detection alongside the runtime scan."
canonical: https://turbopentest.com/docs/integrations/github
source: "TurboPentest Docs"
---

# GitHub Connection

Connect GitHub to enable white box pentesting with SAST, SCA, and secret detection.

## Two connection methods

### GitHub App (recommended)

The TurboPentest GitHub App provides fine-grained repository access.

1. Go to **Dashboard > Account > GitHub**
2. Click **Install GitHub App**
3. Select the repositories you want to grant access to
4. You are redirected back to TurboPentest

**Benefits:**
- Per-repository access control
- No personal token exposure
- Automatic token refresh

### OAuth

OAuth grants access to all repositories your GitHub account can see.

1. Go to **Dashboard > Account > GitHub**
2. Click **Connect with GitHub**
3. Authorize TurboPentest

**When to use:** If you cannot install GitHub Apps on your organization, or for quick personal repository testing.

## Using GitHub with pentests

Once connected, include the `repoUrl` in your pentest request:

```bash
curl -X POST https://turbopentest.com/api/pentests \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "https://app.example.com",
    "repoUrl": "https://github.com/your-org/your-repo"
  }'
```

This enables Code Scanner (SAST), Dep Scanner (SCA), and Secret Scanner (secret detection) in addition to all black box tools.

## Create GitHub issues from findings

The same GitHub connection can also file an issue for each finding when a pentest completes - no second credential to store.

1. Go to **Dashboard > Account > Notifications** (the Integrations tab links here too)
2. Enable **GitHub Issues** and choose a ticket style and minimum severity
3. By default, issues go to the pentest's connected repo; you can point them at an explicit `owner/repo` instead

Each issue is created with the `turbopentest` label plus a severity label, and includes the finding title, severity, proof of exploit, remediation, and a link back to the full report. Choose **one issue per finding** or a **single summary issue**, and set a **minimum severity threshold** so only findings at or above a chosen severity are filed.

> **Note:** Issue creation requires the GitHub connection to carry `issues: write`. GitHub Apps request this scope during install; for a PAT, grant the `issues` (or `repo`) scope.

## Managing connections

View and manage your GitHub connections in **Dashboard > Account > GitHub**. You can:
- See which repositories are accessible
- Disconnect a connection
- Switch between OAuth and GitHub App