GitHub
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The GitHub connector integrates with the GitHub REST API v3 to synchronize code repositories along with their Dependabot, code scanning, and secret scanning security alerts into the Brinqa platform.
- Authentication: GitHub App (App ID + PEM private key)
- Protocol: REST API (v3)
- Scope: Organization installations only; each sync enumerates every installed organization
- Pagination: Cursor-based (default) or page-based (configurable for GitHub Enterprise Server)
The connector synchronizes the following categories of data:
- Repositories — repository metadata, security-analysis settings, and promoted custom properties
- Code Scanning Alerts and their rule Definitions
- Dependabot Alerts and their advisory Definitions
- Secret Scanning Alerts and a generated CWE-798 Definition
Data retrieved from GitHub
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Repository | Yes | Code Repository |
| Code Scanning Alert | Yes | Static Code Finding |
| Code Scanning Alert Definition | Yes | Static Code Finding Definition |
| Dependabot Alert | Yes | Open Source Finding |
| Dependabot Alert Definition | Yes | Open Source Finding Definition |
| Secret Scanning Alert | Yes | Static Code Finding |
| Secret Scanning Alert Definition | Yes | Static Code Finding Definition |
Model relationships
note
For detailed steps on how to view the data retrieved from GitHub in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select GitHub from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | No | https://api.github.com | GitHub API URL |
| App ID | Yes | — | GitHub app identifier |
| Private key | Yes | — | GitHub app private key (PEM) |
| Page size | No | 100 | Maximum number of records to get per API request |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
| Repository custom properties | No | — | Comma delimited list of case-insensitive custom property names to promote as attributes on the repository. |
| Enable Cursor Pagination | No | true | Enable cursor-based pagination for cloud (default). Uncheck for GitHub Enterprise Server that requires page-based pagination. |
| Locations fetch threads | No | — | Number of threads used to concurrently fetch secret scanning alert locations when location loading is enabled. |
Authentication
The connector authenticates as a GitHub App using a two-step JWT + installation access token flow.
- A JSON Web Token (JWT, RS256) is generated from the App ID and the PEM-encoded private key (valid for 10 minutes).
- The JWT is exchanged for a short-lived installation access token, which is refreshed automatically on expiry.
Endpoint
| Method | URL |
|---|---|
POST | {url}/app/installations/{installationId}/access_tokens |
Request Headers
| Header | Value |
|---|---|
Authorization | Bearer <jwt> |
Accept | application/vnd.github+json |
Usage
Once obtained, the installation access token is sent on all subsequent API requests:
Authorization: Bearer <installation-access-token>
Accept: application/vnd.github+json
X-GitHub-Api-Version: 2022-11-28
Content-Type: application/json
Sync Behavior
Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.
How to obtain GitHub credentials
Obtain the required credentials (appId, privateKey) from your GitHub administrator or the GitHub admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Repository
| Source Field Name | SDM Attribute |
|---|---|
| constant Code Repository | CATEGORIES |
installation.account.id | ORG_ID |
installation.account.login | ORG_NAME |
later of repository.pushed_at / repository.updated_at | LAST_SEEN |
later of repository.pushed_at / repository.updated_at | SOURCE_LAST_MODIFIED |
repository.archived | IS_ARCHIVED |
repository.created_at | FIRST_SEEN |
repository.created_at | SOURCE_CREATED_DATE |
repository.default_branch | DEFAULT_BRANCH |
repository.description | DESCRIPTION |
repository.disabled | IS_DISABLED |
repository.fork | IS_FORK |
repository.forks_count | FORKS_COUNT |
repository.has_discussions | DISCUSSION_ENABLED |
repository.has_downloads | DOWNLOADS_ENABLED |
repository.has_issues | ISSUES_ENABLED |
repository.has_pages | PAGES_ENABLED |
repository.has_projects | PROJECTS_ENABLED |
repository.has_wiki | WIKI_ENABLED |
repository.homepage | HOME_PAGE |
repository.html_url | HTML_URL |
repository.is_template | IS_TEMPLATE |
repository.language | LANGUAGES |
repository.license.key | LICENSE |
repository.name | NAME |
repository.node_id | UID |
repository.open_issues_count | OPEN_ISSUES_COUNT |
repository.owner.login | OWNER |
repository.private | IS_PRIVATE |
repository.properties.values[].value | CM_<name> |
repository.pushed_at | PUSHED_AT |
repository.security_and_analysis.advanced_security.status | ADVANCED_SECURITY |
repository.security_and_analysis.dependabot_security_updates.status | DEPENDABOT_SECURITY_UPDATES |
repository.security_and_analysis.secret_scanning.status | SECRET_SCANNING |
repository.security_and_analysis.secret_scanning_non_provider_patterns.status | SECRET_SCANNING_NON_PROVIDER_PATTERNS |
repository.security_and_analysis.secret_scanning_push_protection.status | SECRET_SCANNING_PUSH_PROTECTION |
repository.security_and_analysis.secret_scanning_validity_checks.status | SECRET_SCANNING_VALIDITY_CHECKS |
repository.size | SIZE |
repository.stargazers_count | STARGAZERS_COUNT |
repository.topics | TOPICS |
repository.url | URL |
repository.visibility | VISIBILITY |
repository.watchers_count | WATCHERS_COUNT |
repository.web_commit_signoff_required | WEB_COMMIT_SIGNOFF_REQUIRED |
| sync timestamp | LAST_CAPTURED |
Code Scanning Alert
| Source Field Name | SDM Attribute |
|---|---|
alert.created_at | FIRST_FOUND |
alert.created_at | SOURCE_CREATED_DATE |
alert.dismissed_at | DISMISSED_AT |
alert.dismissed_by.login | DISMISSED_BY |
alert.dismissed_reason | DISMISS_REASON |
alert.fixed_at | LAST_FIXED |
alert.html_url | HTML_URL |
alert.most_recent_instance.analysis_key | ANALYSIS_KEY |
alert.most_recent_instance.commit_sha | COMMIT_SHA |
alert.most_recent_instance.environment (key:value) | TAGS |
alert.most_recent_instance.location (path#Lstart-Lend) | PATH |
alert.most_recent_instance.message.text | RESULTS |
alert.most_recent_instance.ref | AFFECTED_BRANCH |
alert.most_recent_instance.state | PROVIDER_STATUS |
alert.number | ALERT_NUMBER |
alert.repository.id | TARGETS |
alert.repository.id | REPO_ID |
alert.repository.name | REPO_NAME |
alert.rule.id | TYPE |
alert.tool.guid | TOOL_GUID |
alert.tool.name | TOOL_NAME |
alert.tool.version | TOOL_VERSION |
alert.updated_at | LAST_FOUND |
alert.updated_at | SOURCE_LAST_MODIFIED |
alert.url | URL |
| derived from status | STATUS_CATEGORY |
installation.account.id | ORG_ID |
installation.account.login | ORG_NAME |
MD5 of Static:{org}:{repo}:{alert.number} | UID |
normalized alert.most_recent_instance.state | STATUS |
normalized alert.most_recent_instance.state | SOURCE_STATUS |
| sync timestamp | LAST_CAPTURED |
Code Scanning Alert Definition
| Source Field Name | SDM Attribute |
|---|---|
alert.rule.description (else alert.rule.name) | NAME |
alert.rule.full_description | DESCRIPTION |
alert.rule.help | RECOMMENDATION |
alert.rule.id | UID |
alert.rule.security_severity_level | SOURCE_SEVERITY |
alert.rule.security_severity_level | RULE_SECURITY_SEVERITY |
alert.rule.severity | RULE_SEVERITY |
alert.rule.tags not starting with external/ | TAGS |
alert.rule.tags starting with external/cwe/ | CWE_IDS |
alert.rule.tags starting with external/cwe/ | WEAKNESSES |
| derived from severity | SEVERITY_SCORE |
normalized alert.rule.security_severity_level | SEVERITY |
| sync timestamp | LAST_CAPTURED |
Dependabot Alert
| Source Field Name | SDM Attribute |
|---|---|
alert.created_at | FIRST_FOUND |
alert.created_at | SOURCE_CREATED_DATE |
alert.dependency.manifest_path | PATH |
alert.dependency.scope | SCOPE |
alert.dismissed_at | DISMISSED_AT |
alert.dismissed_by.login | DISMISSED_BY |
alert.dismissed_reason | DISMISS_REASON |
alert.fixed_at | LAST_FIXED |
alert.html_url | HTML_URL |
alert.number | ALERT_NUMBER |
alert.repository.id | TARGETS |
alert.repository.id | REPO_ID |
alert.repository.name | REPO_NAME |
alert.security_advisory.ghsa_id | TYPE |
alert.security_advisory.ghsa_id | GHSA_ID |
alert.security_vulnerability.first_patched_version.identifier | PATCHED_VERSION |
alert.security_vulnerability.package | PACKAGE_NAME |
alert.security_vulnerability.vulnerable_version_range | AFFECTED_VERSIONS |
alert.state | PROVIDER_STATUS |
alert.updated_at | LAST_FOUND |
alert.updated_at | SOURCE_LAST_MODIFIED |
alert.url | URL |
| derived from status | STATUS_CATEGORY |
installation.account.id | ORG_ID |
installation.account.login | ORG_NAME |
MD5 of Dependabot:{org}:{repo}:{alert.number} | UID |
normalized alert.state | STATUS |
normalized alert.state | SOURCE_STATUS |
| package / affected versions / patched version summary | RESULTS |
| sync timestamp | LAST_CAPTURED |
upgrade guidance (package + first patched version) | RECOMMENDATION |
Dependabot Alert Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from severity | SEVERITY_SCORE |
normalized security_advisory.severity | SEVERITY |
security_advisory.cve_id + identifiers[type=CVE].value | CVE_IDS |
security_advisory.cve_id + identifiers[type=CVE].value | CVE_RECORDS |
security_advisory.cvss.vector_string | CVSS V3 metrics |
security_advisory.cvss_severities.cvss_v4.vector_string | CVSS V4 metrics |
security_advisory.cwes[].cwe_id | CWE_IDS |
security_advisory.cwes[].cwe_id | WEAKNESSES |
security_advisory.description | DESCRIPTION |
security_advisory.ghsa_id | UID |
security_advisory.ghsa_id | GHSA_ID |
security_advisory.published_at | PUBLISHED_DATE |
security_advisory.references[].url | REFERENCES |
security_advisory.severity | SOURCE_SEVERITY |
security_advisory.summary | NAME |
security_advisory.updated_at | SOURCE_LAST_MODIFIED |
security_advisory.withdrawn_at | WITHDRAWN_AT |
| sync timestamp | LAST_CAPTURED |
Secret Scanning Alert
| Source Field Name | SDM Attribute |
|---|---|
alert.created_at | FIRST_FOUND |
alert.created_at | SOURCE_CREATED_DATE |
alert.html_url | HTML_URL |
alert.locations_url | LOCATIONS_URL |
alert.number | ALERT_NUMBER |
alert.push_protection_bypassed | PUSH_PROTECTION_BYPASSED |
alert.push_protection_bypassed_at | PUSH_PROTECTION_BYPASSED_AT |
alert.push_protection_bypassed_by.login | PUSH_PROTECTION_BYPASSED_BY |
alert.repository.id | TARGETS |
alert.repository.id | REPO_ID |
alert.repository.name | REPO_NAME |
alert.resolution | RESOLUTION |
alert.resolution_comment | RESOLUTION_COMMENT |
alert.resolved_at | LAST_FIXED |
alert.resolved_by.login | RESOLVED_BY |
alert.secret_type | SECRET_TYPE |
alert.secret_type_display_name | SECRET_NAME |
alert.state | PROVIDER_STATUS |
alert.updated_at | LAST_FOUND |
alert.updated_at | SOURCE_LAST_MODIFIED |
alert.url | URL |
alert.validity | VALIDITY |
| constant BRINQA-CWE-798 | TYPE |
| derived from status | STATUS_CATEGORY |
installation.account.id | ORG_ID |
installation.account.login | ORG_NAME |
locations[].details (from alert.locations_url) | LOCATIONS |
locations[].details.end_column | END_COLUMN |
locations[].details.end_line | END_LINE |
locations[].details.path (from alert.locations_url) | LOCATIONS_PATH |
locations[].details.start_column | START_COLUMN |
locations[].details.start_line | START_LINE |
MD5 of alert.secret | SECRET |
MD5 of Secret:{org}:{repo}:{alert.number} | UID |
normalized alert.state | STATUS |
normalized alert.state | SOURCE_STATUS |
| secret name / type / MD5-redacted secret summary | RESULTS |
| sync timestamp | LAST_CAPTURED |
Secret Scanning Alert Definition
| Source Field Name | SDM Attribute |
|---|---|
| constant BRINQA-CWE-798 | UID |
| constant BRINQA-CWE-798 | CWE_IDS |
| constant BRINQA-CWE-798 | WEAKNESSES |
| constant Use of Hard-coded Credentials | NAME |
| generated CWE-798 description | DESCRIPTION |
| generated CWE-798 remediation | RECOMMENDATION |
| sync timestamp | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Repository
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Repository on every run and applies no incremental date filter.
API
- Type: REST endpoint
Code Scanning Alert
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
severity | String (comma-separated) | — | Filter by severity (error, warning, note, low, medium, high, critical). The Code Scanning API accepts one severity per request, so each value triggers a separate API call. |
Delta sync
Not supported. The connector performs a full sync of Code Scanning Alert on every run and applies no incremental date filter.
API
- Type: REST endpoint
Code Scanning Alert Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Code Scanning Alert Definition on every run and applies no incremental date filter.
API
- Type: REST endpoint
Dependabot Alert
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
severity | String (comma-separated) | — | Filter by severity (low, medium, high, critical). The Dependabot API accepts the full comma-separated list in a single request. |
Delta sync
Not supported. The connector performs a full sync of Dependabot Alert on every run and applies no incremental date filter.
API
- Type: REST endpoint
Dependabot Alert Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Dependabot Alert Definition on every run and applies no incremental date filter.
API
- Type: REST endpoint
Secret Scanning Alert
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
secret_type | String (comma-separated) | — | Filter by secret type identifiers (e.g. github_personal_access_token, aws_access_key_id). Each value triggers a separate API request. |
load_locations | Boolean | false | When true, fetches each alert's locations and populates the LOCATIONS_PATH, START_LINE, START_COLUMN, END_LINE, END_COLUMN, and LOCATIONS attributes. Adds one or more API requests per alert. |
Delta sync
Not supported. The connector performs a full sync of Secret Scanning Alert on every run and applies no incremental date filter.
API
- Type: REST endpoint
Secret Scanning Alert Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Secret Scanning Alert Definition on every run and applies no incremental date filter.
API
- Type: Generated (no API call)
Changelog
The GitHub connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 4.0.24 | New Features - Added the multivalued Locations path, Start line, Start column, End line, and End column attributes to the Secret Scanning Alert model. These capture the file locations where each secret scanning alert was detected and are fetched from the alert's locations_url - Added the multivalued Locations attribute to the Secret Scanning Alert model. Each value combines a single file location into path@startLine:startColumn - endLine:endColumn format - Added the load_locations operation option to the Secret Scanning Alert sync. Set it to true to fetch each alert's locations and populate the location attributes; it defaults to false, in which case the locations endpoint is not called Improvements - Secret scanning alert locations are fetched concurrently to reduce sync time while staying within GitHub's secondary rate limits - New Locations fetch threads configuration setting (default 4) controls how many threads are used to fetch secret scanning alert locations concurrently - Registered all multivalued attributes with the collection consolidation criteria so every value is preserved during consolidation. This applies to the new Secret Scanning Alert location attributes and to the Repository model's Topics and custom-property attributes | N/A |
| 4.0.23 | Bug Fixes - Restored severity-based filtering for Dependabot alerts — the severity operation option now correctly filters alerts by severity level (supports comma-separated values: low,medium,high,critical) - Restored severity-based filtering for Code Scanning alerts — the severity operation option now correctly filters alerts by severity level (supports: error,warning,note,low,medium,high,critical) Improvements - Severity values with extra whitespace are now automatically trimmed for Dependabot alerts (e.g., "high, critical" is treated as "high,critical") | N/A |
| 4.0.22 | New Features - Added configurable pagination mode for Dependabot alert retrieval, enabling support for GitHub Enterprise Server (GHES) instances that do not support cursor-based pagination - Extended configurable pagination mode to Code Scanning alert retrieval, applying the same cursor-based vs. page-based toggle for consistent behavior across all alert types Improvements - Pagination mode defaults to cursor-based for GitHub Cloud (no change for existing integrations) - New cursorPagination configuration toggle (enabled by default). Uncheck to use page-based pagination for GitHub Enterprise Server | N/A |
| 4.0.21 | Improvements - Repository custom property attributes are now consistently emitted as multi-valued, preserving every value for properties that contain lists - Dependabot Alerts now include the repository identifier and source created/modified dates; severity details continue to be carried on the Dependabot Alert Definition - Streamlined the attribute sets on the Code Scanning, Dependabot, and Secret Scanning alert definitions to remove fields that did not apply to those models Bug Fixes - Secret Scanning Alerts now populate the repository identifier with the correct repository ID value (it was previously duplicating the repository name field) | • Secret Scanning Alert: The repository identifier value was corrected — re-sync Secret Scanning Alerts to refresh stored values. • Dependabot Alert / Code Scanning Alert Definition / Dependabot Alert Definition / Secret Scanning Alert Definition: Several attributes were removed or relocated — re-sync these models so stale attributes are cleared. |
| 4.0.20 | Bug Fixes - Repository custom properties that contain multiple values are now fully captured. Previously the schema treated custom properties as single-valued and dropped all but the first value. | • Repository: Custom property attributes changed from single-valued to multi-valued — re-sync Repositories to capture complete custom property values. |
| 4.0.19 | Improvements - Refreshed the connector documentation, including a model overview, authentication details, and a model relationship diagram Dependency Upgrades - Updated internal connector model and parent connector libraries; added test-only dependencies. No functional impact on existing integrations. | N/A |
| 4.0.18 | Improvements - Severity details are now consolidated on the Dependabot Alert Definition. The Dependabot Alert no longer carries duplicate severity attributes, reducing redundancy across the alert and its definition. | • Dependabot Alert: Severity, severity score, and source severity attributes were removed from the alert (they remain on the Dependabot Alert Definition) — re-sync Dependabot Alerts so the removed attributes are cleared. |
| 4.0.17 | New Features - Added severity-based filtering for Code Scanning and Dependabot alerts via a severity operation option, allowing syncs to be scoped to specific severity levels (comma-separated values are supported) | N/A |
| 4.0.16 | Improvements - Improved Code Scanning alert retrieval reliability with refined pagination handling for large result sets | N/A |
| 4.0.15 | Improvements - Improved Dependabot alert retrieval reliability by following GitHub's pagination links, ensuring all alerts are captured for organizations with large numbers of alerts | N/A |
| 4.0.14 | Bug Fixes - Repository syncs no longer fail when an organization's repositories cannot be retrieved. Such requests are now skipped and logged so the overall sync can continue. | N/A |
| 4.0.13 | Bug Fixes - Corrected the formatting of Code Scanning alert location identifiers so column positions are recorded consistently | N/A |
| 4.0.12 | Improvements - Code Scanning alert locations now include column positions in addition to line numbers, providing more precise location detail | N/A |
| 4.0.11 | Improvements - Detected secrets are now stored as a one-way hash rather than a partially masked value, improving handling of sensitive secret data | N/A |
| 4.0.10 | New Features - Added lifecycle management so repositories and their findings are automatically retired when no longer reported, and findings inherit the lifecycle of their parent repository - Added a Provider Status attribute on Code Scanning, Dependabot, and Secret Scanning alerts that preserves the original status value reported by GitHub Improvements - The Source Status attribute on all alert types now reflects the normalized finding status, providing consistent status values across alert models | • Code Scanning Alert / Dependabot Alert / Secret Scanning Alert: The Source Status attribute now stores a normalized value instead of the raw GitHub value (the raw value moved to the new Provider Status attribute) — re-sync these models to refresh stored status values. |
| 4.0.9 | Improvements - Secret Scanning alerts can now be retrieved per secret type, allowing the secret_type option to be provided as a comma-separated list | N/A |
| 4.0.8 | Improvements - Added a Last Fixed attribute to Dependabot alerts | N/A |
| 4.0.7 | New Features - Added a secret_type operation option for Secret Scanning alerts, allowing syncs to be scoped to specific secret types | N/A |
| 4.0.6 | Improvements - Repository custom properties now support array (multi-value) values in addition to single string values | N/A |
| 4.0.5 | Improvements - Added dismissal details to Dependabot alerts, including who dismissed the alert, when it was dismissed, and the dismissal reason | N/A |
| 4.0.4 | Improvements - Added a Scope attribute to Dependabot alerts indicating the dependency scope (e.g., runtime or development) | N/A |
| 4.0.3 | Improvements - Added an HTML URL attribute to repositories, providing a direct link to the repository on GitHub | N/A |
| 4.0.2 | Bug Fixes - Repository security setting attributes (Advanced Security, Dependabot security updates, secret scanning options) now report a proper enabled/disabled boolean rather than a raw status string | • Repository: The Advanced Security and Dependabot Security Updates attributes changed type from text to boolean — re-sync Repositories to refresh the affected attribute values. |
| 4.0.1 | Improvements - Added an HTML URL attribute to Dependabot alerts and a manifest path attribute to alert dependencies | N/A |
| 4.0.0 | Overview The GitHub connector integrates with GitHub to synchronize code repositories along with Dependabot, code scanning, and secret scanning security alerts and their definitions. Category: Application Security Models | N/A |