Skip to main content

​
How Amnify authenticates

Amnify connects to GitHub through the Amnify Agent GitHub App. You install the app on your organization or account and grant it access to all repositories in your organization or only the repositories you choose. GitHub issues the app a short-lived installation token at scan time; there is no long-lived secret for you to generate, paste, or rotate. Every action Amnify takes runs as the installation you authorized, scoped to exactly the repositories you selected and the permissions listed below. You can narrow the repository list or revoke access entirely at any time from GitHub → Settings → Installed GitHub Apps or within Amnify.

Install the Amnify Agent GitHub App

Install the app on your organization or account and select which repositories Amnify may access. You choose the repositories, and you can change or revoke the selection at any time.

​
Why GitHub is not read-only

The cloud providers Amnify connects to — Azure, AWS, and GCP — are strictly read-only: Amnify reads their configuration to assess posture and changes nothing. GitHub is different. Amnify scans your repositories for issues like leaked secrets, vulnerable dependencies, insecure code patterns, and infrastructure-as-code misconfigurations — and then it prepares merge-ready fixes. Delivering a fix means writing to the repository, so the Amnify Agent GitHub App requests write access. That write access is deliberately bounded by how Amnify uses it:
  • Amnify never commits or pushes to your default branch (such as main).
  • Every change is written to a new branch and delivered as a pull request.
  • Nothing merges without your approval. You review the pull request like any other and merge it or close it yourself.
In other words, Amnify can propose changes but cannot ship them. Your existing branch protections, required reviews, and CI checks all still apply to the pull requests Amnify opens.

​
Steps to connect

1

Install the GitHub App

Open the Amnify Agent GitHub App and click Install. Choose the organization or account to install it on.
2

Select the repositories

Choose Only select repositories and pick the repositories you want Amnify to scan and fix. You can add or remove repositories later without reinstalling. Installing on an organization may require an organization owner to approve the app first.
3

Confirm the permissions

GitHub shows the exact permissions the app requests (the four listed in Tier 1 below). Review and approve them to finish installing.
4

Review the pull requests Amnify opens

When Amnify finds an issue it can fix, it opens a pull request from a new branch against your repository. Review it and merge it if you’re satisfied.

​
Tier 1: Repository access (required)

The Amnify Agent GitHub App requests four repository permissions, scoped to the repositories you select:

​
How access is scoped and revoked

  • Scoped by repository. The app only sees the repositories you select during installation. Repositories you don’t select are invisible to Amnify.
  • Short-lived tokens. Amnify authenticates with installation access tokens that GitHub issues on demand and that expire automatically. No static credential is stored on your behalf.
  • Change the scope anytime. In GitHub → Settings → Installed GitHub Apps → Amnify Agent → Configure, add or remove repositories.
  • Revoke anytime. From the same page, Suspend or Uninstall the app to immediately cut off all access. Any pull requests Amnify already opened stay in your repository for you to merge or close as you see fit.
What Amnify never does on GitHub
  • Never pushes to your default branch. Changes only ever arrive as a pull request from a new branch.
  • Never merges its own pull requests. You review and merge, your branch protections and required reviews still apply.
  • Never touches repositories you didn’t select, and never requests organization-wide administration, member management, or account settings access.
  • Never asks for a personal access token or password. Access is a revocable GitHub App installation, scoped to the repositories you choose.