Skip to main content

​
How Amnify authenticates

Amnify connects to GitHub through the Amnify GitHub App. You install the app on your organization or account and grant it access to all repositories in your organization or only the repositories you choose. GitHub issues the app a short-lived installation token at scan time; there is no long-lived secret for you to generate, paste, or rotate. Every action Amnify takes runs as the installation you authorized, scoped to exactly the repositories you selected and the permissions listed below. You can narrow the repository list or revoke access entirely at any time from GitHub > Settings > Installed GitHub Apps or within Amnify.

Install the Amnify GitHub App

Install the app on your organization or account and select which repositories Amnify may access. You choose the repositories, and you can change or revoke the selection at any time.

​
Why GitHub is not read-only

The cloud providers Amnify connects to, Azure, AWS and GCP, are strictly read-only: Amnify reads their configuration to assess posture and changes nothing. GitHub is different. Amnify scans your repositories for issues like leaked secrets, vulnerable dependencies, insecure code patterns, and infrastructure-as-code misconfigurations, and then it prepares merge-ready fixes. Delivering a fix means writing to the repository, so the Amnify GitHub App requests write access. That write access is deliberately bounded by how Amnify uses it:
  • Amnify never commits or pushes to your default branch (such as main).
  • Every change is written to a new branch and delivered as a pull request.
  • Nothing merges without your approval. You review the pull request like any other and merge it or close it yourself.
In other words, Amnify can propose changes but cannot ship them. Your existing branch protections, required reviews, and CI checks all still apply to the pull requests Amnify opens.

​
Steps to connect

1

Install the GitHub App

In Amnify, click Connect on the GitHub card on Sources (or Connect more in the GitHub section to add another organization). GitHub opens the Amnify GitHub App for you to install. Choose the organization or account to install it on. Each organization is its own source in Amnify, with its own repositories.
2

Select the repositories

Choose Only select repositories and pick the repositories you want Amnify to scan and fix. You can add or remove repositories later without reinstalling. Installing on an organization may require an organization owner to approve the app first.
3

Confirm the permissions

GitHub shows the exact permissions the app requests (the four listed in Tier 1 below). Review and approve them to finish installing.
4

Review the pull requests Amnify opens

When Amnify finds an issue it can fix, it opens a pull request from a new branch against your repository. Review it and merge it if you’re satisfied.

​
Tier 1: Repository access (required)

The Amnify GitHub App requests four repository permissions, scoped to the repositories you select:

​
How access is scoped and revoked

  • Scoped by repository. The app only sees the repositories you select during installation. Repositories you don’t select are invisible to Amnify.
  • Short-lived tokens. Amnify authenticates with installation access tokens that GitHub issues on demand and that expire automatically. No static credential is stored on your behalf.
  • Change the scope anytime. In GitHub > Settings > Installed GitHub Apps > Amnify > Configure, add or remove repositories.
  • Revoke anytime. From the same page, Suspend or Uninstall the app to immediately cut off all access. Any pull requests Amnify already opened stay in your repository for you to merge or close as you see fit.
  • Reinstall without starting over. To restore access after uninstalling, install the app again with Connect more in the GitHub section on Sources. Amnify links the new installation to the organization it already has, so its repository selection, schedules and findings are kept, apart from any repositories the new installation cannot reach.

​
Signing in with GitHub

Signing in to Amnify with GitHub uses the same app, but it is not an installation. GitHub asks you to authorize the app, with one account permission: Authorizing gives Amnify no access to your repositories, and Amnify keeps no GitHub token from the sign-in. Repositories are connected only by installing the app, as above. The authorization is listed under GitHub > Settings > Applications > Authorized GitHub Apps. If you revoke it there, GitHub asks you to authorize the app again the next time you sign in.
What Amnify never does on GitHub
  • Never pushes to your default branch. Changes only ever arrive as a pull request from a new branch.
  • Never merges its own pull requests. You review and merge, your branch protections and required reviews still apply.
  • Never touches repositories you didn’t select, and never requests organization-wide administration, member management, or account settings access.
  • Never asks for a personal access token or password. Access is a revocable GitHub App installation, scoped to the repositories you choose.