Do I need to install a GitHub App?

No. Fora AI uses a GitHub Personal Access Token, so there is nothing to install or approve as an organization admin — you paste a token and connect a repo in under a minute.

Where do I see the scan results?

On the GitHub Integrations page in your Fora AI dashboard, under 'Last push scan' for that repo — click through to the full report, same as a manual scan.

Is my GitHub token safe?

Your token is stored only to read the connected repo and manage its webhook. It is never shown again after you paste it, and disconnecting a repo removes the webhook from GitHub immediately.

GitHub Integration Guide — Scan on Every Push

Q: Which branch gets scanned?

Only pushes to the repository's default branch (usually main or master) trigger a scan. Pushes to other branches are ignored.

What it does

Once a repo is connected, Fora AI watches for pushes to its default branch (usually main or master). Every time you push, we pull the latest snapshot of the repo, run it through the same scan engine as a manual ZIP upload, and save a full report — findings, severity breakdown, and a security score — to your dashboard.

Connect a repo in 3 steps

Create a GitHub Personal Access Token

Go to github.com/settings/tokens and generate a fine-grained token scoped to the repo you want to connect, with Contents: Read and write and Webhooks: Read and write permissions.

Paste it into GitHub Integrations

In your dashboard, open GitHub Integrations, enter the repo as owner/repo, paste the token, and click Connect repo. Fora AI verifies access and registers a push webhook on the repo for you.

Push code as usual

The next push to the default branch — from your terminal, an IDE, or even a direct commit in the GitHub UI — triggers a scan within seconds. No extra command, no CI file to add to your repo.

Where results show up

Every push scan appears in two places: the GitHub Integrations page, next to the repo it belongs to, and your normal Scan History — it's treated exactly like a manually uploaded ZIP scan, so it counts toward the same plan limits and shows the same detailed report.

Disconnecting a repo

Click Disconnect next to any connected repo. Fora AI removes the webhook from GitHub immediately and deletes the stored token — pushes to that repo stop triggering scans right away.

Security & privacy

Your token is used only to read the connected repo's contents and to create/remove its webhook — nothing else.
Every push notification from GitHub is verified with a per-repo signed secret before any scan runs, so nobody else can trigger a scan on your account.
Disconnecting a repo deletes the token and webhook from our side and from GitHub in the same action.

Frequently asked questions

No. Fora AI uses a Personal Access Token, so there's nothing to install or get organization-admin approval for — connecting a repo takes under a minute.

Only pushes to the repository's default branch (usually main or master) trigger a scan. Pushes to feature branches are ignored.

Check the webhook's Recent Deliveries tab in your GitHub repo's Settings → Webhooks. A red/failed delivery there means GitHub couldn't reach Fora AI (check the response code); no delivery at all usually means the push landed on a branch other than the default one, or the repo's free-plan scan quota is used up.

Yes — it's stored only to read the connected repo and manage its webhook, it's never displayed again after you paste it, and disconnecting the repo removes it immediately.

Ready to connect a repo?

Head to GitHub Integrations in your dashboard and paste your token.

Start scanning free