How to Connect GitHub to SecureSpect
Install the SecureSpect GitHub App on your organization and configure it to automatically monitor branch protection, PR approvals, and repository security settings.
Ready to connect? Follow the steps in SecureSpect — the integration dialog walks you through the same process described here.
Open Integrations →Overview
SecureSpect's GitHub integration monitors your organization's repositories for SOC 2-relevant security controls: branch protection rules, required PR approvals, commit signing, secret scanning, dependency alerts, and more.
The integration uses a GitHub App — a first-class GitHub integration mechanism that provides fine-grained permissions, organization-level access, and automatic token rotation. No personal access tokens are needed.
Prerequisites
- A SecureSpect account and workspace
- GitHub organization owner permissions (required to install GitHub Apps)
Step 1 — Navigate to the GitHub Integration
Step 2 — Install the SecureSpect GitHub App
Click the link in the dialog to open the GitHub App installation page. You'll be redirected to GitHub.
On the installation screen:
- Select your organization (not a personal account).
- Under Repository access, choose:
- Or Selected repositories — if you want to limit monitoring to specific repos.
- Click Install.
Step 3 — Copy the Installation ID
After installation, GitHub redirects you to a confirmation page. The URL contains:
?installation_id=12345678
Copy that number — it's your Installation ID.
You can also find it later in: GitHub → Organization Settings → GitHub Apps → SecureSpect → Configure. The URL on that page contains the installation ID.
Step 4 — Complete the Connection
Return to SecureSpect and enter:
- Installation ID — the number from Step 3
- Organization login — your GitHub org's slug (the part after
github.com/)
What SecureSpect Monitors
Once connected, SecureSpect checks:
| Control | What's checked |
| Branch protection | Default branch protection is enabled |
| Required PR approvals | At least 1 required reviewer |
| Dismiss stale reviews | Reviews dismissed on new push |
| Require status checks | CI must pass before merge |
| Restrict force pushes | Force pushes to default branch blocked |
| Secret scanning | Secret scanning enabled |
| Dependency alerts | Dependabot alerts enabled |
| SAML enforcement | SSO enforced at org level |
Troubleshooting
"Invalid installation ID"
Double-check the number — it's the installation_id query parameter, not the App ID. App ID and installation ID are different.
"Organization not found"
The org login is case-sensitive in some contexts. Use lowercase. Example: acme-corp, not Acme-Corp.
Missing repositories in scan results
If you chose "Selected repositories" during installation, only those repos are visible to SecureSpect. Expand the installation to All repositories to cover your full org.
Revoking Access
To disconnect: go to GitHub → Organization Settings → GitHub Apps → SecureSpect → Uninstall. SecureSpect immediately loses access. Previously collected evidence is retained in SecureSpect for audit history.
