GitHub Advanced Security — Integration Setup

Prerequisites

• GitHub repositories with GitHub Advanced Security (GHAS) enabled — code scanning, Dependabot alerts, and/or secret scanning
• A GitHub personal access token or GitHub App installation token with read access to security alerts
• CMDash Essentials tier or above

Step 1: Create a Token

Option A — Fine-grained personal access token (recommended):

1. In GitHub, go to Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
2. Select the specific repositories you want CMDash to monitor.
3. Under Repository permissions, grant Read-only access to:
   • Code scanning alerts
   • Dependabot alerts
   • Secret scanning alerts
4. Generate the token and copy it — it is shown only once.

Option B — GitHub App installation token: if your org already uses a GitHub App for tooling, add the same three read-only security permissions to it and use its installation token instead.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find GitHub Advanced Security and click Connect.
3. Enter:
   • Token (stored as this connection's access token)
   • Repositories — a list of owner/repo strings to monitor (e.g., acme-corp/api, acme-corp/web)
4. Click Save & Test Connection.

Note: CMDash syncs exactly the repositories you list (as owner/repo) and nothing else. To read every non-archived repository of the GitHub organization you entered (up to 500), enter * as the only entry; the token then needs access to all of them. A list that is empty, or that contains even one entry that is not an owner/repo name, is refused with a message saying what to fix. CMDash never widens a list you gave it to the whole organization.

What Syncs

Each of the three alert types is fetched per repository, 100 open alerts per request, following GitHub's Link: rel="next" header until the last page (up to 50 pages, 5,000 alerts, per alert type per repository). Secret scanning alerts are always normalized as critical-severity incidents, regardless of the secret type. If a repository doesn't have a given GHAS feature enabled (or the token cannot see it), GitHub returns 404 or 403 for that alert type. CMDash does not read that as "zero alerts": the connection shows as Limited with a note naming the repository and the alert type, so a repository that is not actually being monitored never looks clean. One repository's answer never fails the sync. A different failure for a repository (a server error) loses that repository's alerts for the run and is recorded as partial.

Troubleshooting

• 401 Unauthorized: Token expired or was revoked; generate a new one and update the connection.
• 403 Forbidden: The token lacks the security_events permission (classic PATs) or the specific fine-grained repository permission for the alert type in question.
• Connection shows "Limited" with a 404 or 403 note: GitHub answered 404 or 403 for that repository and alert type — the feature is not enabled (Settings → Code security and analysis) or the token has no access to it. Enable the feature or remove the repository from the list; the note goes away on the next sync.
• More than 5,000 open alerts for one alert type in one repository: the sync stops at the 50-page ceiling and is recorded as partial with a warning.

Rate Limits & Sync Behavior

Credential Rotation

Personal access tokens can be given an expiration date at creation (GitHub recommends 90 days for fine-grained tokens). CMDash displays a 30-day expiry warning banner if the token you provided carries expiry metadata GitHub exposes via the API.

To rotate:

1. Generate a new fine-grained token following Step 1, with the same repository selection and permissions.
2. In CMDash: Settings → Integrations → GitHub Advanced Security → Edit.
3. Enter the new Token and Save.
4. Once confirmed healthy, revoke the old token in GitHub.

Multiple Instances / Multi-Site

If you use GitHub Enterprise Server (self-hosted) in addition to github.com, or want to segment repositories by business unit with different tokens, create additional connections.

To add another connection:

1. In CMDash: Settings → Integrations → Add Integration → GitHub Advanced Security.
2. Enter the token and repository list for the additional scope.
3. Give the connection a descriptive name (e.g., GitHub - Platform Team, GitHub - Mobile Team).
4. Click Save & Test Connection.

Findings across all connections are merged in the CMDash compliance dashboard.

Compliance Framework Coverage

The GitHub Advanced Security integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.