.ai
All integrations

Available integration

GitHub

Checks organization access defaults, repository controls, and high-risk Dependabot alert coverage.

AvailableRead-only collection

What vCISO.ai observes

  • Organization two-factor authentication status
  • Default repository permission policy
  • Visible repository inventory
  • Default branch protection and review requirements
  • Open high and critical Dependabot alert summary

Authorization and permissions

GitHub OAuth or a GitHub App installation

  • OAuth: read:org
  • OAuth: read:user
  • GitHub App access remains limited to the repositories selected during installation

Setup path

Setup remains administrator-controlled inside the authenticated workspace.

  1. Authorize the GitHub connection
  2. Choose the organization or approved App installation
  3. Run the first read-only collection
  4. Review the resulting checks and proposed evidence

Collection limitations

A limited or failed read stays visible and never becomes a passing result.

  • Results cover only organizations and repositories visible to the authorized connection
  • Collection of repository, branch-protection, and Dependabot data follows documented resource and reporting limits
  • Unavailable permissions are reported as limited coverage, not a passing result

Disconnect and deletion behavior

An administrator can disconnect the integration. vCISO.ai removes stored access locally, expires connector-derived evidence, and records the change. GitHub authorization can also be removed in GitHub.

  • Existing historical records remain available as review history
  • Connector-derived evidence is marked expired when the source is disconnected
  • Disconnect is organization-scoped and audit logged
A provider observation can support a control only after the right relationship and evidence are reviewed. Connecting GitHub does not automatically verify a control, complete a framework, or produce an audit conclusion.

Start with the roadmap

Put GitHub into a prioritized readiness plan.

Build the free roadmap first, then activate the AI vCISO when you are ready to connect the provider.

Get my readiness roadmapSee all integrations