Secure GitHub with Mondoo

Mondoo continuously scans a GitHub organization or individual repositories for misconfigurations and vulnerabilities. Deploy the integration once and Mondoo keeps assessments up to date as repos change.

PrerequisitesCopy Anchor Link

• Editor or Owner access to the Mondoo space
• Access to a GitHub organization or repository

Create a GitHub personal access tokenCopy Anchor Link

A personal access token gives Mondoo permission to read GitHub resources on your behalf.

1. Log into GitHub. Verify your email if you haven't already.

2. Select your profile photo in the top-right corner, then Settings.

3. In the left sidebar, select Developer settings, then Personal access tokens > Tokens (classic).

4. Select Generate new token > Generate new token (classic).

5. Under Note, describe the token's purpose (for example, Mondoo security scan access).

6. Set an Expiration.

7. Under Select scopes, check:

   • public_repo
   • read:org
   • read:repo_hook
   • admin:org_hook
   • read:project
   To scan private repositories, select the entire repo scope instead of only public_repo. The full repo scope is also required for checks that read a repository's Actions workflows (for example, verifying that a vulnerability scanner such as Dependabot, CodeQL, or Trivy runs in CI). Without it, GitHub returns a 404 for the workflows endpoint and those checks fail as if no scanning workflow were configured.

8. Select Generate token and copy the value. You need it in the next section.

Add a GitHub integrationCopy Anchor Link

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select INSTALL. On the Install Integration page, find the integration you want by browsing a category or searching by name:

1. Under SaaS Security, select GitHub.

   

2. Under Integration Type, choose what to scan:

   • Scan a GitHub organization. In Organization, enter the organization name.
   • Scan a personal account. In Account, enter the login of the personal GitHub account.
   • Scan a single repository. Enter the Owner and Repository names from the repo's URL. For example, if the URL is github.com/Lunalectric/frontend, the owner is Lunalectric and the repo is frontend.

3. Paste your personal access token into Personal Access Token.

4. (Optional) In Integration Name, enter a name that identifies the GitHub organization, account, or repository. If you leave it empty, Mondoo uses the name of the organization or repository you scan.

5. (Optional) For GitHub Enterprise Server, enter your server's URL (for example, https://github.mycompany.com) in GitHub Enterprise Server URL. Leave it empty for github.com.

6. Under Discovery and scan options, turn on what you want Mondoo to scan inside the repositories:

   • Static code analysis (on by default): analyze repository source code for security issues (SAST).
   • Secrets detection (on by default): detect committed credentials and other secrets.
   • Dependency vulnerability scanning (on by default): scan repository dependencies for known vulnerabilities (SCA).
   • Discover Terraform files: scan Terraform configuration files in the repositories.
   • Discover Kubernetes manifests: scan Kubernetes manifest files in the repositories.

   

7. (Optional) Under Enable security policies (optional), enable the policies you want Mondoo to score your GitHub assets against.

8. (Optional) Under Set Annotations (optional), select + ADD ANNOTATION to add key-value pairs that Mondoo applies to every asset this integration discovers. To learn more, read Annotate assets.

9. Select START SCANNING.

Mondoo scores this integration against the policies you enable under Enable security policies (optional) in the setup form. You can enable or disable policies at any time. To learn how policies work, read Manage Policies.

After you connectCopy Anchor Link

Once GitHub scanning is enabled, explore your asset inventory, then assess and improve your security to review and prioritize your findings.

Learn moreCopy Anchor Link

• Mondoo GitHub Resource Pack Reference