What GitHub permissions does Kikimora need?

A read-scoped token or GitHub App installation covering the organization. That is enough to read code scanning alerts, repository security settings, and Dependabot findings. The integration is read-only by default.

Does it read my source code?

It reads security metadata, the alerts, settings, and dependency findings, rather than crawling your code. It surfaces the risk signals GitHub already produces, in conversation.

How long does it take to connect GitHub?

A few minutes. Install the app or create a read-scoped token at the org level. There is nothing to add to your repositories or CI.

Can it audit settings across every repo at once?

Yes. You can ask org-wide questions, for example which repositories have branch protection or secret scanning disabled, and get one answer across all of them.

GitHub Security Integration: Manage It by Chat

Code scanning alerts, repository security settings, and Dependabot - security shifted left, conversationally.

Kikimora plugs into GitHub to surface code-level risk where you talk about everything else. Query code scanning alerts, audit repository security settings, and track Dependabot findings across the organization.

Shift security left from one conversation

The integration covers the security signals GitHub produces around your code: code scanning (CodeQL and partner) alerts, repository security settings such as branch protection and secret scanning, and Dependabot vulnerability alerts. The value is org-wide reach. Instead of checking settings repo by repo, you ask one question and the agent reports across every repository, then ties a code finding back to the service it ships to. GitHub gives you strong security controls, but they are configured per repository, which means consistency is the hard part. A single repo with branch protection switched off or secret scanning never enabled is the gap an attacker needs, and finding it by hand across hundreds of repositories does not happen. The agent makes the org-wide audit a sentence, so the outlier repository surfaces instead of hiding in the count.

What you can do

List open code scanning alerts across repos, sorted and filtered.
Audit repository security settings org-wide.
Track Dependabot vulnerability alerts and their fixes.
Correlate code findings with deployed infrastructure.

Things you might ask

“Which repositories in the org have branch protection or required reviews turned off?”
“Show me every critical Dependabot alert and whether a patched version exists yet.”
“Group open code scanning alerts by rule so I can knock out the most common one first.”

Code is one layer of the DevSecOps picture. Pair GitHub with the SonarCloud integration so static analysis hotspots sit next to your scanning alerts, and with Vercel so a finding in a repo connects to where that code is actually deployed.