SecurityChecks

GitHub Permissions

What permissions SecurityChecks requests and why

GitHub App Permissions

When you install the SecurityChecks GitHub App, we request only the minimum permissions needed to scan your code and report results.

Permissions We Request

Repository Permissions

PermissionLevelWhy We Need It
ContentsReadTo clone and analyze your code during scans
Pull requestsWriteTo post findings as PR comments
ChecksWriteTo create check runs that block merges on critical findings
MetadataReadTo list repositories you can connect

Organization Permissions

PermissionLevelWhy We Need It
MembersReadTo sync team membership for access control

What We DON'T Do

  • We don't store your source code. Code is analyzed in memory and discarded.
  • We don't access private data. We only read code files, not issues, wikis, or secrets.
  • We don't modify your code. We only read and comment.
  • We don't access other repos. Only repos you explicitly connect.

How Scans Work

  1. You trigger a scan (manually, on PR, or scheduled)
  2. We clone your repo to a secure, isolated environment
  3. We run our 100 security checkers against the code
  4. We generate findings with evidence
  5. We post results to your PR or dashboard
  6. We delete the cloned code immediately

Data Retention

  • Findings: Stored for 12 months (configurable)
  • Code snippets: Only the lines relevant to findings
  • Full source: Never stored, deleted after scan

Revoking Access

You can revoke access at any time:

  1. Go to GitHub → Settings → Applications → Installed GitHub Apps
  2. Click SecurityChecks → Configure
  3. Click "Uninstall"

This immediately revokes all access. Your findings remain in SecurityChecks until you delete your project.

Questions?

Contact us at security@securitychecks.ai for any concerns about permissions or data handling.

Managing FindingsAPI Authentication