Imports organization members, repositories, Dependabot alerts and fine-grained access tokens from GitHub (github.com or Enterprise Server), for IAM, privileged-access, credential-hygiene and software-inventory metrics.
There are two ways to connect: installing the HARVEN GitHub App, which asks you to copy no credential at all, or registering your own App — required for GitHub Enterprise Server, on which a public github.com App cannot be installed.
For the general flow of adding a source, see Connect Data Sources.
Before you start
A GitHub organization — a personal account cannot be used
Being an organization owner: required to install the App, and the 2FA status of members is only readable at that level
For GitHub Enterprise Server, the API root of your instance
A personal access token is never accepted: it cannot read the organization's token list, and it carries one person's visibility rather than the organization's.
Option A — Connect with the HARVEN GitHub App
Open Workspace → Data sources → Add → GitHub
Click Connect GitHub
On GitHub, pick the organization to read, then come back to HARVEN
Nothing to copy: the installation is recorded on your return, and the base URL and organization are filled in for you. If you are not allowed to install Apps, GitHub queues the request instead — an owner of the organization has to approve it, then click Connect GitHub again.
If the form tells you that no HARVEN GitHub App is published on your environment, use Option B.
Option B — Use your own GitHub App
Open Settings → Developer settings → GitHub Apps → New GitHub App — create it from the organization if you can, it then stays private and installs directly
Grant the permissions listed below, then save
Under General → About, note the App ID
Under General → Private keys, click Generate a private key and keep the .pem file — it is shown only once
Under Install App, install it on your organization
Back in HARVEN, open Use your own GitHub App and fill in the base URL, organization, App ID and private key
App permissions (all read-only)
Each permission feeds one table. An App granted fewer of them still works — the tables it cannot read stay empty.
Organization → Members — members, 2FA status, invitations
Organization → Personal access tokens — the access-tokens table
Repository → Metadata — repositories
Repository → Dependabot alerts — Dependabot alerts
Grant Personal access tokens, not Personal access token requests, which covers the approval workflow instead. A permission added after installing must be approved by an organization owner before it takes effect.
What to enter in HARVEN
Base URL — GitHub API root: https://api.github.com for github.com, or your instance's API root for Enterprise Server, e.g. https://github.example.com/api/v3 (GitHub REST API documentation, or your Enterprise Server instance)
Organization — Login of the organization to read, as it appears in the URL (github.com/<organization>)
GitHub App ID — Numeric identifier of the App (App settings → General → About → App ID)
Private key — Contents of the .pem file; paste it or drop the file onto the field (App settings → General → Private keys)
On the HARVEN App path only the connector name is yours to fill: the rest arrives from GitHub.
What HARVEN reads
org_members — Organization members: login, role, state, two_factor_disabled — MFA, organization role and membership state
repos — Repositories: full_name, visibility, private, archived — source-code exposure and archived scope
dependabot_alerts — Dependabot alerts: package_name, ecosystem, severity, state, fixed_at — known-vulnerable components and remediation latency
org_pat — Fine-grained access tokens: owner_login, token_expired, token_expires_at, token_last_used_at — standing and dormant credentials
Official documentation
Need help? Contact [email protected].
