Configure GitHub for Code Assessment
Connect the Pentest Copilot GitHub App, choose repositories, and enable pull request or push automation for Code Assessment.
Code Assessment connects to GitHub through the Pentest Copilot GitHub App.
After the GitHub App is installed, Pentest Copilot can read selected repositories, create check results, comment on pull requests, create issues, and open fix pull requests when you enable those workflows.
Before You Start
You need:
access to Pentest Copilot with permission to manage integrations or run Code Assessment;
GitHub permission to install a GitHub App on the target organization or account;
approval for the repositories that will be scanned;
for automatic pull request or push scans, the repository must be connected in Pentest Copilot and have scan settings saved.
Installing the GitHub App alone does not automatically scan every repository. Automatic scans only start for repositories that you connect and configure in Pentest Copilot.
Connect the GitHub App
In Pentest Copilot, open Settings -> Integrations -> GitHub or Modules -> Code Assessment.
Click Connect GitHub.
GitHub opens the Pentest Copilot GitHub App installation page.
Choose the GitHub organization or account.
Select All repositories or Only select repositories.
Approve the installation.
Return to Pentest Copilot and confirm the integration shows as connected.
If a repository is missing, open the GitHub App installation settings in GitHub and add that repository to the App's repository access list.
Use the Right Pentest Copilot Account
Always start the installation from Connect GitHub inside the Pentest Copilot account where you want the repositories to appear.
If your organization uses more than one Pentest Copilot account or workspace, open the correct one before connecting GitHub.
Connect Repositories in Pentest Copilot
After the App is installed, open Settings -> Integrations -> GitHub or Modules -> Code Assessment.
You can configure repositories in two ways:
Standalone Code Assessment repository
Adds the repository as a Code Assessment target.
You want source-code scans, scheduled scans, pull request scans, push scans, SBOM, AI-BOM, and code findings.
Repository connected to a domain
Links a repository to an external application domain.
You want external findings on that domain to be patchable against the connected source repositories.
You can use both. A repository can be a direct Code Assessment target and also be connected to a domain.
Enable Automatic Scans
Automatic scans are configured per repository from Modules -> Code Assessment -> Scan settings.
Pull request
On
The latest commit on the pull request.
Push
Off
The commit that was pushed, only when push scans are enabled and the branch matches the repository settings.
Pull request scans run when a pull request is opened, reopened, marked ready for review, or updated with new commits.
Push scans ignore tags and branch deletions. With no branch filter, push scans run only on the repository default branch. With branch filters, the pushed branch must match one of the saved regular expressions.
Examples:
main
Only main.
release/.*
Branches such as release/2026.07 and release/hotfix.
feature/.+
Feature branches with at least one character after feature/.
Common Blocks
GitHub redirects to the App settings page instead of Pentest Copilot
Start the install again from Connect GitHub in Pentest Copilot. If it still does not return to Pentest Copilot, contact BugBase support.
Repository does not appear
Confirm the App installation has access to that repository.
Pull request event did not start a scan
Confirm the repository is connected in Pentest Copilot and Scan every pull request is enabled for that repository.
Push event did not start a scan
Confirm Scan pushes is enabled and the pushed branch matches the saved branch filters.
Repositories appear in the wrong Pentest Copilot account
Disconnect GitHub and reconnect it from the account where you want to run Code Assessment.
Last updated