Connect GitHub

Imports organization members, repositories, Dependabot alerts and fine-grained access tokens from GitHub (github.com or Enterprise Server) for IAM, privileged-access, credential-hygiene and software-inventory metrics.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

• A GitHub organization — a personal account cannot be used

• Being an organization owner: required to install the App, and 2FA status is only readable at that level

• For GitHub Enterprise Server, the API root of your instance

• A personal access token is never accepted: it cannot read the organization's token list, and it carries one person's visibility rather than the organization's

Setup

Option A — Connect with the HARVEN GitHub App

1. Click Connect GitHub

2. On GitHub, pick the organization to read, then come back to HARVEN

Nothing to copy: the installation is recorded on your return, and the base URL and organization are filled in for you. If you are not allowed to install Apps, GitHub queues the request instead: an owner of the organization has to approve it, then click Connect GitHub again. If the form says no HARVEN GitHub App is published on your environment, use Option B.

Option B — Use your own GitHub App

Required for GitHub Enterprise Server, which a public github.com App cannot be installed on. Follow steps 1 to 3 below, then open Use your own GitHub App in the form and fill in the fields.

Step 1 — Determine the base URL

For github.com the URL is https://api.github.com. For GitHub Enterprise Server, use your instance's API root, e.g. https://github.example.com/api/v3.

Step 2 — Create and install a GitHub App

1. Open Settings → Developer settings → GitHub Apps → New GitHub App (create it from the organization if you can: it stays private and installs directly)

2. Grant the permissions listed below, then save

3. Under General → About, note the App ID

4. Under General → Private keys, click Generate a private key and keep the .pem file (shown only once)

5. Under Install App, install it on your organization

Step 3 — App permissions (all read-only)

Each permission feeds one table; an App granted fewer of them still works, the tables it cannot read stay empty.

⚠️ Not Personal access token requests, which covers the approval workflow. Permissions added after installing must be approved by an organization owner before they take effect.

Fields to fill in HARVEN

Collected data

• org_members — Organization members: MFA, organization role and membership state (login, role, state, two_factor_disabled)

• repos — Repositories: Source-code exposure and archived scope (full_name, visibility, private, archived)

• dependabot_alerts — Dependabot alerts: Known-vulnerable components and remediation latency (package_name, ecosystem, severity, state, fixed_at)

• org_pat — Fine-grained access tokens: Standing and dormant credentials (owner_login, token_expired, token_expires_at, token_last_used_at)

Official documentation

• Registering a GitHub App

Need help? Contact [email protected].