GitHub security — connect GitHub to Argus

What Argus sees on GitHub

The specific signals, on this platform

Argus treats every platform with the depth it deserves — these are theGitHub-specific signals the mesh produces.

Repositories and their dependencies

Every connected repo is mapped: which package managers, which manifests, which lockfiles. The dependency graph drives reachability — Argus only escalates a CVE on a package your code actually imports, not on transitive dead weight.

Secrets in source and history

API keys, tokens and credentials get caught the moment they land in a commit. History is scanned on the first connection so a secret that leaked six months ago does not stay in your blind spot.

Workflow and CI signals

GitHub Actions workflows are read for misconfigurations, exposed secrets in logs, and supply-chain risk in third-party actions. Findings link back to the workflow file so the fix is one commit.

Set up in three steps

From zero to a mesh in under five minutes

Authorise the GitHub App

Click Connect → GitHub in Argus. Approve the GitHub App and select the repositories you want covered. Read-only scopes only.

Choose what to scan

Pick the orgs and repos. Argus indexes the dependency graph, reads the relevant manifests and starts producing findings.

Hook the response to GitHub

Optionally let Argus open pull requests for the safe fixes (lockfile bumps, secret rotations) and gate disruptive actions behind your review.

Findings you will see

What ends up in your queue

— Reachable CVEs in npm, pip, gem, go and cargo manifests

— Leaked API keys, tokens and provider credentials across source and history

— Misconfigured Actions workflows and risky third-party actions

— License risks on imported dependencies (where policy is configured)

Read further

Topic hubs and audience pages

Secret detection

The discipline this connector sits inside, with field notes from the team.

Vulnerability & CVE management

The discipline this connector sits inside, with field notes from the team.

Solo and indie builders

How this connector fits the audience that uses it most.

Pricing

Unlimited targets on every paid tier. AI usage is what is metered.

GitHub FAQ

Questions, answered

Does Argus need write access?

No. Read-only scopes are sufficient for discovery and findings. Write access is only requested if you opt in to automated pull requests for safe fixes.

Does it cover private repos?

Yes, on every paid tier. The GitHub App scopes are bound to the repositories you select; nothing else is read.

What about monorepos with many packages?

Each package manifest is treated independently. Reachability is computed per package, so a CVE in one workspace does not light up every other one.

Will it slow down my CI?

No. Scanning runs in Argus, not your runners. The pull-request fixes (when you opt in) are deltas, not full audits.

What if I host code on GitLab or Bitbucket?

Both are on the roadmap. The architecture is platform-agnostic; the connectors are the work. Tell us from /contact what you need.

Does Argus replace GitHub Advanced Security?

For the indie-builder and small-team profile, often yes — Argus covers the same surface (CodeQL-style reachability, secret scanning, dependency review) at a price point GHAS is not built for. If you already pay for GHAS, the two run alongside.

GitHub security in one mesh