Skip to main content
The GitHub integration enables LaunchSafe to clone your repositories for white-box scanning and open auto-fix pull requests when vulnerabilities are discovered.

​
Prerequisites

  • A GitHub account with admin access to the repository or organization you want to scan
  • The repository must be accessible to the GitHub App (public or private with app installation)

​
Installation

1

Navigate to Integrations

In the LaunchSafe dashboard, go to Integrations in the sidebar and click Connect GitHub.
2

Install the GitHub App

You’ll be redirected to GitHub to install the LaunchSafe GitHub App. Choose whether to install it for:
  • All repositories — grants access to every repo in the organization (current and future)
  • Select repositories — choose specific repos to grant access to
3

Authorize

Review the permissions and click Install & Authorize. You’ll be redirected back to LaunchSafe.
4

Verify connection

Back in LaunchSafe, you should see your GitHub organization and repositories listed. The integration status should show Connected.

​
Permissions

The LaunchSafe GitHub App requests the following permissions: LaunchSafe does not request access to:
  • Issues, discussions, or wikis
  • Actions, workflows, or secrets
  • Organization members or teams
  • Billing or administration

​
Scanning a repository

Once connected, your GitHub repositories appear as targets when creating a new scan:
  1. Go to New Scan in the sidebar
  2. Select GitHub Repository as the source
  3. Choose the repository from the dropdown
  4. Select the branch to scan (defaults to the default branch)
  5. Configure scan type and launch

​
Branch selection

You can scan any branch in your repository. Common patterns:
  • Default branch (main/master) — scan your production code for a baseline assessment
  • Feature branches — scan before merging to catch vulnerabilities early
  • Release branches — scan before deployment as a final security gate

​
Auto-fix pull requests

When LaunchSafe discovers a vulnerability with an available automated fix, it creates a pull request:

​
What gets created

  • Branch: launchsafe/fix-{finding-id} — clearly identified as a LaunchSafe fix
  • Title: Descriptive title referencing the vulnerability (e.g., “Fix SQL injection in auth.ts”)
  • Description: Full context including:
    • What vulnerability was found
    • Why it’s a security issue
    • What the fix does
    • Link back to the finding in LaunchSafe
  • Changes: The minimal code change required to remediate the vulnerability

​
Supported auto-fix types

​
Review process

Auto-fix PRs are suggestions — they should be reviewed like any other pull request:
  1. Review the code changes for correctness
  2. Run your test suite to verify nothing breaks
  3. Check that the fix doesn’t introduce regressions
  4. Merge when satisfied
Always review auto-fix PRs before merging. While LaunchSafe generates correct fixes in the vast majority of cases, your application’s specific context may require adjustments.

​
Revoking access

To disconnect GitHub:
  1. In LaunchSafe: go to Integrations → GitHub → Disconnect
  2. In GitHub: go to Settings → Applications → LaunchSafe → Uninstall
Revoking access immediately stops LaunchSafe from accessing your repositories. Existing findings and reports from previous scans are retained.