01
Install and scope the connection
Connect over OAuth or an app install and choose exactly what GitHub shares — you can revoke it on your side at any time
GitHub is wired in twice: a GitHub App you install on the repositories you choose opens remediation issues and tracks them back to your controls, and read-only checks verify that two-factor authentication is enforced and default branches are protected.
4 read-only checks, run on a schedule. Each failure becomes a finding linked to a control — every check is listed, none are “coming soon”.
Fails if the GitHub organization does not enforce two-factor authentication for all members. Note: `two_factor_requirement_enabled` is returned as null when the token lacks organization-owner visibility, which this check treats as a failure (fail-closed) — use an org-owner token to get an accurate result.
org-two-factor-required
Fails if the repository's default branch has no branch-protection rule and no repository ruleset requiring at least one approving pull-request review, or if the classic protection rule does not require one before merging.
default-branch-protected
Fails if Dependabot vulnerability alerts are not enabled on the repository. GitHub returns 204 when alerts are enabled and 404 when they are not; anything else is treated as disabled (fail-closed).
dependabot-alerts-enabled
Fails if secret scanning is not enabled on the repository. Note: the `security_and_analysis` block is returned as null when the token lacks repository-admin visibility, which this check treats as a failure (fail-closed) — use a repo-admin token for an accurate result.
secret-scanning-enabled
Bring your current platform's test list — we'll map it against these checks, gap by gap
Open issues in your repositories for remediation work, and devguard tracks each one as your team updates and closes it, over a GitHub App you install on the repos you choose.
Setup is minutes, not a migration project — and every step stays on your side
Connect over OAuth or an app install and choose exactly what GitHub shares — you can revoke it on your side at any time
The first run starts right after connecting, then repeats on a schedule. Results are timestamped, so your evidence has a history, not a snapshot.
Passing results attach as evidence to the controls they support; failures become findings you triage. When the audit comes, the proof is already connected.
Open any page for its full check register.
You create and scope every credential yourself, and you can revoke it at any time. Checks only read; results and evidence are stored in Switzerland and stay exportable.
Yes. The checks authenticate with a credential you create and scope yourself, and only ever read configuration. devguard holds no write access to GitHub and remediates nothing silently.
A failed check becomes a finding linked to the control it supports, with the evidence attached. You decide the treatment — nothing pages your engineers and nothing is auto-remediated.
Checks run from Swiss infrastructure, and results and evidence are stored in Switzerland. Everything is exportable — your evidence stays yours.
No. The GitHub App writes issues, never code, and you choose which repositories it can see. The compliance checks use a separate read-only token and only read organization and repository settings.
Organization-level settings like enforced 2FA require a GitHub organization. Branch-protection checks work on any plan that supports protected branches.
20 minutes on how you run certification today. Bring your current test or control list and we'll map it against these checks — honestly, gap by gap.