# GitHub > GitHub: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads issues, pull requests, their comments and the Markdown documents of the GitHub repositories you name, so engineering agents can answer from the design notes and the issue history. Optionally it reads every text file of the default branch (code) of named repositories or whole organisations. ## At a glance | Collector | GitHub, version `1.0.0` | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Reads | GitHub: GitHub REST API (github.com and GitHub Enterprise Server) ([the vendor's documentation](https://docs.github.com/en/rest)) | | Family | Engineering | | Kind | Code | | Ways to connect | Access token | | Scopes | - Read: `Metadata: read`, `Contents: read`, `Issues: read`, `Pull requests: read` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Identity | | Hosts it may contact | `api.github.com`, `codeload.github.com` | | Vendor API versions | GitHub REST API, X-GitHub-Api-Version 2022-11-28 | | Lowest engine version | `0.47.1` | ## What it reads - Issues and pull requests (GitHub lists both with issues): title, body, comments, state, labels and the repository. Read since the newest `updated_at` seen per repository. - Markdown files (`*.md`) on the default branch, optionally only under `doc_paths`. The cursor keeps each file’s blob sha; an unchanged file is not fetched, and a file that leaves the tree is withdrawn. - With `code: true`: every text file of the default branch, from one tarball per repository, re-read only when the repository’s `pushed_at` moves. `orgs` names organisations whose every repository is read. - Left out of code reads: version-control internals, dependency and build directories (`node_modules`, `build`, `vendor`, …), lockfiles, binaries and generated files by suffix, empty files and files over `max_file_bytes` (256 KiB). Each skip is counted by reason. - Never read: wikis and Actions or CI results. ## How to connect 1. Create a fine-grained personal access token limited to the repositories you want, with only the permissions below. 2. In LightHouse, open **Connectors**, choose **GitHub**, name the repositories (`owner/name`), a label and how often to read, and paste the token. 3. In code, give the deployment the token as `GITHUB_TOKEN` from your secret store and add a `kind: github` source card with `repos` (and `orgs` with `code: true` where wanted), `label` and `requires`. 4. For GitHub Enterprise Server set `base_url` to `https:///api/v3`. A source that sets `credential_env: ""` reads public repositories without a token. ## Permissions Read only. For a fine-grained token: Metadata read, Contents read, Issues read and Pull requests read. The collector sends only `GET` requests to the API root (`api.github.com` by default, or the Enterprise Server’s host) and, for code reads, to `codeload.github.com` through the tarball redirect. The Authorization header is removed before a redirect is followed, as the redirect target carries its own short-lived token. Its read-only test proves it on every change. ## Limits - You must name repositories or, with `code: true`, organisations; an organisation is never the default. - A repository tree too large for GitHub to return whole is a failure, not a partial sync: reading half the documents and withdrawing the rest would empty the index. - A listing that has lost more than 25 repositories and more than a tenth of those the last pull knew fails the pull rather than withdrawing them. - A rate limit is waited out (the tarball stream waits for the reset); a 304 does not count against GitHub’s limit, so a quiet repository costs nothing. - Files over `max_file_bytes` (256 KiB) are skipped in code reads. - Documents have no modified date, so a pull compares blob shas, not dates. ## Data handling - Issue, comment and document text is copied into the deployment’s corpus under the source’s `label`. Comments carry the author’s login. Repositories can hold personal data and secrets in text; use a restrictive label for code. - The token stays in your secret store and is never written to logs or run notes; it is sent only to the API host. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------- | | `not owner/name repositories` | A repository is not written `owner/name` | Correct the name | | `name the repositories to sync; an organisation is never the default` | Neither `repos` nor `orgs` is set | Name the repositories | | `orgs reads every repository's code: it needs code: true` | `orgs` was given without `code: true` | Set `code: true`, or use `repos` | | `base_url must be an https URL` | An Enterprise Server address that is not https | Use the https API root | | `credential variable 'GITHUB_TOKEN' is not set` | The token variable is empty | Set it, or `credential_env: ""` for public repositories | | `the tree is truncated; name doc_paths to narrow it` | The repository is too large for one tree listing | Set `doc_paths` | | `refusing to delete` | The organisation listing lost most of the repositories the last pull knew | Check the token’s access; it is not a deletion | | `HTTP 401` or `HTTP 403` | The token is revoked, expired or lacks access to the repository | Make a new token with the permissions above | | Read succeeded, 0 written | Nothing changed since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------------------------ | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.45.0` | GitHub REST API, X-GitHub-Api-Version 2022-11-28 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/github/