Repository scope stays provider-controlled
GitHub's installation screen determines which repositories the app can access.
Provider-specific workflow
Validate authorized GitHub repositories through a repeatable product-security workflow.
The GitHub workflow uses selected GitHub App installation scope and short-lived tokens for supported code and repository-control validations.
Why This Matters
Code and controls need different checks
Code validation examines repository content; configuration audit reads supported GitHub controls.
A scan becomes useful when repeated
History and a later validation show whether supported evidence changed.
What SecOpsium Scans
- Supported secret and code findings in the selected repository and branch.
- Supported GitHub configuration controls when audit is selected.
- Supported web exposure for separately supplied public targets.
- Current and historical validation evidence.
Validation workflow
- 1Install or connect the GitHub App.
- 2Grant the intended repository scope in GitHub.
- 3Choose the repository, branch, and validation type.
- 4Review and remediate prioritized evidence.
- 5Run another validation or maintain a schedule.
Frequently Asked Questions
Is a GitHub personal access token required?
No. The hosted workflow uses a GitHub App.
Can a private repository be validated?
Yes, when it is in the authorized GitHub App installation scope.