Skip to content

Repository Access Configuration

VirtualSutra AI can scan your source code repositories for security vulnerabilities, hardcoded secrets, misconfigurations, and code-level compliance gaps. To do this it needs a read-only access token.

GitHub

What you need

Field Description
Platform GitHub
Owner GitHub organisation or username (e.g. my-org)
Repository Repository name (e.g. my-app) - or leave blank to scan all repos in the org
Token A read-only Personal Access Token

Creating a token

Fine-grained tokens scope access to specific repos and permissions. 1. Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. Click Generate new token 3. Set Expiration - 90 days is a reasonable default 4. Under Repository access, select the repos you want to scan (or All repositories for the org) 5. Under Permissions → Repository permissions, grant: | Permission | Level | |------------|-------| | Contents | Read-only | | Metadata | Read-only | 6. Click Generate token and copy it immediately

  1. Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)
  2. Click Generate new token (classic)
  3. Select the repo scope (grants read access to code, commits, and metadata)
  4. Set an expiration and click Generate token

Organisation repos

If the repositories are in a GitHub organisation, make sure your token is authorised for that organisation (SSO organisations require explicit authorization after creation).

GitLab

What you need

Field Description
Platform GitLab
Namespace Group or username (e.g. my-group)
Repository Project name (e.g. my-app)
Token A project or group access token with read_repository scope

Creating a token

  1. Go to your GitLab project → Settings → Access tokens
  2. Create a new token with Role: Reporter (minimum)
  3. Select scope: read_repository
  4. Set an expiration date
  5. Copy the token

To scan multiple projects under a group with a single token: 1. Go to your GitLab group → Settings → Access tokens 2. Create a token with Role: Reporter and scope read_repository 3. This token will work for all projects under the group

GitHub organization-level scanning

In addition to scanning individual repositories, VirtualSutra can scan your GitHub organization's own security settings, separate from any one repo's code. Enable it on a GitHub repository connection to check for:

  • Organization-wide two-factor authentication enforcement
  • Default GitHub Actions permissions (e.g. whether Actions can approve pull requests)
  • Organization and Dependabot secrets scope
  • IP allowlist configuration

This runs in-process alongside the existing per-repository scan (no separate agent or container is involved). It uses the same connection's token, but note that organization-level checks (2FA enforcement, IP allowlist, org-wide secrets scope) call GitHub's organization-scoped APIs: a token that only grants repository-level access may not be able to read every organization-level setting. If a fine-grained token is used, also grant it read access to the relevant organization settings; a classic token with the admin:org scope (read) covers this fully.

Token security

  • Store tokens in your team's secrets manager (1Password, Vault, AWS Secrets Manager, etc.)
  • Use the minimum required scopes - never write access
  • Rotate tokens before they expire to avoid inspection failures
  • If a token is compromised, revoke it immediately on the provider and create a new one

Scanning multiple repositories

Add each repository as a separate entry in the inspection wizard. All repositories are scanned in parallel by the codebase-analyzer agent. Findings are tagged with their source repository and file path.

Next step

Go back to Running an Inspection and add your repositories to the wizard.