> ## Documentation Index
> Fetch the complete documentation index at: https://docs.octopoda.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect GitHub with the Octopoda GitHub App

> Install the Octopoda GitHub App to scan repositories from the web app and check pull requests, choose which repositories it can read, and see its permissions.

The Octopoda GitHub App lets Octopoda read the repositories you choose, so you can scan them from the web app and check their pull requests. You sign in to Octopoda with GitHub either way; the app is what gives Octopoda access to code. Scans from the CLI upload code directly and do not need it.

## Install the app

**1. Start from Octopoda**

In [app.octopoda.dev](https://app.octopoda.dev), select **Install the GitHub App** on the **Overview** or **Repositories** page. You can also install it from [github.com/apps/octopoda-security](https://github.com/apps/octopoda-security).

**2. Pick the account and repositories**

On GitHub, choose your personal account or an organization, then **All repositories** or **Only select repositories**. Installing on an organization needs an organization owner, or an owner's approval.

**3. Return to Octopoda**

GitHub sends you back to Octopoda, which shows the connection and the default pull request checks: **Scan every pull request** on, failing at **High and above**. The repositories appear on the **Repositories** page.

## Change which repositories Octopoda can read

On the **Repositories** page, select **Choose repositories on GitHub**. Repositories you add appear in Octopoda shortly after you save on GitHub.

If you remove a repository, or uninstall the app, the repository shows **Access removed on GitHub**. Its past results are kept, and **Restore access** takes you back to GitHub.

## Who can connect an installation

The person who installed the app on GitHub connects it to their Octopoda account. If someone else installed it, Octopoda asks you to have them connect it. To share repositories with teammates, connect the installation to a team account and invite them. See [Teams and roles](https://docs.octopoda.dev/account/teams.md).

## Permissions

| Permission | Access | What Octopoda uses it for |
| - | - | - |
| Contents | Read | Reading the code of the repositories you choose, for scans. |
| Metadata | Read | Listing repositories and branches. |
| Checks | Write | Creating the pull request check and setting its result. |
| Pull requests | Write | Reading pull request details and posting the summary comment. |
| Email addresses | Read | Your email address, for the notifications you choose. |

The app also has read access to deployments and issues, which Octopoda does not use.

Octopoda reads code only with short-lived, read-only tokens limited to the repository being scanned. See [How Octopoda handles your code](https://docs.octopoda.dev/security/your-code.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.