> ## Documentation Index
> Fetch the complete documentation index at: https://docs.launchsafe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Connect GitHub to LaunchSafe to scan repositories for vulnerabilities and receive auto-fix pull requests with remediation applied to your code.

The GitHub integration enables LaunchSafe to clone your repositories for white-box scanning and open auto-fix pull requests when vulnerabilities are discovered.

## Prerequisites

* A GitHub account with admin access to the repository or organization you want to scan
* The repository must be accessible to the GitHub App (public or private with app installation)

## Installation

<Steps>
  <Step title="Navigate to Integrations">
    In the LaunchSafe dashboard, go to **Integrations** in the sidebar and click **Connect GitHub**.
  </Step>

  <Step title="Install the GitHub App">
    You'll be redirected to GitHub to install the **LaunchSafe** GitHub App. Choose whether to install it for:

    * **All repositories** — grants access to every repo in the organization (current and future)
    * **Select repositories** — choose specific repos to grant access to
  </Step>

  <Step title="Authorize">
    Review the permissions and click **Install & Authorize**. You'll be redirected back to LaunchSafe.
  </Step>

  <Step title="Verify connection">
    Back in LaunchSafe, you should see your GitHub organization and repositories listed. The integration status should show **Connected**.
  </Step>
</Steps>

## Permissions

The LaunchSafe GitHub App requests the following permissions:

| Permission              | Access level | Purpose                                                     |
| ----------------------- | ------------ | ----------------------------------------------------------- |
| **Repository contents** | Read         | Clone source code for SAST, SCA, and secret detection scans |
| **Pull requests**       | Read & Write | Create auto-fix PRs with vulnerability remediation          |
| **Metadata**            | Read         | List repositories, branches, and commit information         |
| **Checks**              | Read & Write | Report scan status as GitHub check runs on PRs              |

LaunchSafe does **not** request access to:

* Issues, discussions, or wikis
* Actions, workflows, or secrets
* Organization members or teams
* Billing or administration

## Scanning a repository

Once connected, your GitHub repositories appear as targets when creating a new scan:

1. Go to **New Scan** in the sidebar
2. Select **GitHub Repository** as the source
3. Choose the repository from the dropdown
4. Select the branch to scan (defaults to the default branch)
5. Configure scan type and launch

### Branch selection

You can scan any branch in your repository. Common patterns:

* **Default branch (`main`/`master`)** — scan your production code for a baseline assessment
* **Feature branches** — scan before merging to catch vulnerabilities early
* **Release branches** — scan before deployment as a final security gate

## Auto-fix pull requests

When LaunchSafe discovers a vulnerability with an available automated fix, it creates a pull request:

### What gets created

* **Branch:** `launchsafe/fix-{finding-id}` — clearly identified as a LaunchSafe fix
* **Title:** Descriptive title referencing the vulnerability (e.g., "Fix SQL injection in auth.ts")
* **Description:** Full context including:
  * What vulnerability was found
  * Why it's a security issue
  * What the fix does
  * Link back to the finding in LaunchSafe
* **Changes:** The minimal code change required to remediate the vulnerability

### Supported auto-fix types

| Vulnerability                 | Auto-fix action                              |
| ----------------------------- | -------------------------------------------- |
| Vulnerable dependency         | Bumps package to patched version in lockfile |
| Hardcoded secret              | Replaces with environment variable reference |
| Missing input sanitization    | Adds parameterized query or input validation |
| Missing security header       | Adds middleware or configuration             |
| Insecure cookie configuration | Adds `Secure`, `HttpOnly`, `SameSite` flags  |

### Review process

Auto-fix PRs are **suggestions** — they should be reviewed like any other pull request:

1. Review the code changes for correctness
2. Run your test suite to verify nothing breaks
3. Check that the fix doesn't introduce regressions
4. Merge when satisfied

<Warning>
  Always review auto-fix PRs before merging. While LaunchSafe generates correct fixes in the vast majority of cases, your application's specific context may require adjustments.
</Warning>

## Revoking access

To disconnect GitHub:

1. In LaunchSafe: go to **Integrations** → **GitHub** → **Disconnect**
2. In GitHub: go to **Settings** → **Applications** → **LaunchSafe** → **Uninstall**

Revoking access immediately stops LaunchSafe from accessing your repositories. Existing findings and reports from previous scans are retained.