GitHub

Developer

Monitor repositories and org settings for secure development controls.

what it checks

GitHub checks in Varman

Connect GitHub to monitor repository security, branch protection, and organization settings. Varman runs 5 checks against GitHub on a schedule and records each result as evidence.

Branch Protection Enabled

high severity

Verify that default branches have protection rules configured

Code Scanning

medium severity

Verifies repositories have GitHub CodeQL or an equivalent static analysis tool configured. Detects default-setup CodeQL, custom CodeQL workflows, and third-party SARIF uploaders.

Dependabot Security Updates Enabled

medium severity

Verify that Dependabot security updates are enabled on repositories

Sanitized Inputs

medium severity

Verifies repositories use a supported input-validation library (JS/TS, Python, or PHP). Scans entire repository including monorepo subdirectories.

2FA Enforcement

high severity

Verify that all GitHub organization members have two-factor authentication enabled

how to connect

Connecting GitHub

An admin adds the details below in Varman under Integrations. Secret values are encrypted before they are stored.

Personal Access Token: GitHub > Settings > Developer settings > Personal access tokens. A classic token needs scopes: repo, read:org, read:user.

More Developer integrations

GitLab Vercel Netlify Jenkins