GitHub Integration

Connect QuantAssure to your GitHub organization to monitor repository security.

What It Collects

  • Repository Inventory — All repositories in your organization as assets
  • Dependabot Alerts — Vulnerability alerts from GitHub's Dependabot
  • Code Scanning Alerts — Vulnerability findings from GitHub code scanning (CodeQL and other SARIF-based scanners), for alerts that carry a security severity
  • Security Settings — Branch protection, secret scanning, and other security configurations

Prerequisites

  • A GitHub account with access to your organization
  • A Personal Access Token (PAT) with the following scopes:
    • repo — Full control of private repositories (for Dependabot alerts)
    • read:org — Read organization membership
    • security_events — Read code scanning alerts (only needed if you enable Code Scanning Alerts)

Setup Steps

1. Generate a Personal Access Token

  1. Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)
  2. Click "Generate new token" → "Generate new token (classic)"
  3. Give it a descriptive name (e.g., "QuantAssure")
  4. Select scopes: repo and read:org. Also select security_events if you plan to enable Code Scanning Alerts
  5. Click "Generate token"
  6. Copy the token immediately — you won't see it again

2. Configure in QuantAssure

  1. Create or edit a System in QuantAssure
  2. In the Data Sources section, enable GitHub
  3. Enter your GitHub organization name
  4. Paste your Personal Access Token
  5. (Optional) Enable Dependabot Alerts extension to collect vulnerability findings
  6. (Optional) Enable Code Scanning Alerts extension to collect vulnerability findings from CodeQL and other code scanning tools
  7. Save your system configuration

3. Run Your First Scan

Click "Run Scan" to collect data from GitHub. The scan will:

  • Fetch all repositories in your organization
  • Collect Dependabot alerts for each repository (if enabled)
  • Collect code scanning alerts for each repository (if enabled)
  • Check security settings on each repository

What to Expect

After your first scan:

  • Assets: One asset per repository in your organization
  • Findings: Dependabot vulnerability alerts (if enabled)
  • Findings include CVE details, severity, and affected package information
  • Findings: Code scanning alerts (if enabled) — only alerts that carry a security severity are turned into findings; lint-grade CodeQL results and other non-security SARIF results are deliberately excluded
  • Code scanning findings are shown with QuantAssure's AI-adjusted severity, which reflects your organizational context; the scanner's original severity is retained for the audit trail
  • If you dismiss an alert in GitHub, it isn't removed from QuantAssure — it's shown as a risk acceptance, with who dismissed it, when, and the reason given
  • Repositories without code scanning enabled are skipped silently — this is expected and doesn't indicate a problem
  • If QuantAssure is temporarily unable to check code scanning for a repository, that repository's existing findings are left unchanged rather than marked resolved — a failed check is never treated as "nothing to report"

Troubleshooting

"Bad credentials" error

  • Verify your Personal Access Token is correct
  • Check that the token hasn't expired
  • Ensure the token has repo and read:org scopes

No Dependabot alerts appearing

  • Verify Dependabot is enabled on your repositories
  • Check that the Dependabot Alerts extension is enabled in QuantAssure
  • Some repositories may not have any alerts

No code scanning alerts appearing

  • Verify code scanning (e.g., CodeQL) is enabled on your repositories
  • Check that the Code Scanning Alerts extension is enabled in QuantAssure
  • Remember that alerts without a security severity — lint-grade CodeQL results, most third-party SARIF uploads — are excluded by design and won't appear as findings
  • If you rely on the GitHub App for near-immediate updates (see connecting a system) rather than waiting for the next scheduled scan, code scanning updates only arrive if that App has been granted the security_events: read permission and is subscribed to the code_scanning_alert webhook event in its GitHub App settings. This is the first thing to check if findings from your scheduled scan look right but live updates never show up — contact support to confirm the App's configuration

Missing repositories

  • Verify your organization name is correct
  • Check that your token has access to the organization
  • Private repositories require the repo scope