​
Overview

The GitHub integration monitors your organization’s repositories, branch protection rules, member access, and security configurations. LowerPlane uses read-only access and does not access source code contents.

​
Authentication

GitHub uses OAuth 2.0 for authentication. When you connect, you’ll be redirected to GitHub to authorize LowerPlane.

​
Required Permissions (OAuth Scopes)

The repo scope appears broad, but GitHub’s classic OAuth does not offer a more granular “read metadata only” scope. LowerPlane only reads repository settings and branch protection rules — never file contents, commits, or diffs.

​
What LowerPlane Collects

Repository Metadata

Name, visibility, language, default branch, open PR count, contributor count

Branch Protection

Required reviews, status checks, admin enforcement, stale review dismissal

Organization Members

Member list with MFA/2FA status for access reviews

Security Alerts

Dependabot vulnerability alert status per repository

​
Security Tests

LowerPlane runs 9 automated tests against your GitHub organization:

​
Repository Classification

After connecting, all synced repositories appear in Operations > Repositories. Each repository must be classified:
  • Production — All security tests are enforced. Branch protection, peer review, and status checks must be configured.
  • Non-production — Automatically marked as compliant. No security checks required.

​
Connecting

1

Navigate to Integrations

Go to Settings > Integrations and find GitHub in the Developer Tools category.
2

Click Connect

Click the Connect button. You’ll be redirected to GitHub’s authorization page.
3

Authorize

Review the requested permissions and click Authorize. You must be an organization owner or admin.
4

Initial Sync

LowerPlane performs an initial sync of your repositories, members, and security settings. This typically takes 1-2 minutes.

​
Pull Request Reviews & Status Checks

LowerPlane collects approver names on pull requests and status check results to verify that peer review and CI/CD gates are enforced before merging. This data is used by the “Code changes should be reviewed by peers” and “Merging should require passing status-checks” tests.

​
Data Access