GitHub
Your dependency tree is a vendor list nobody calls one. Urengi reads the org's repositories and their dependency manifests, so the packages and services your product actually runs on get reviewed like any other supplier.
- Category
- Engineering
- Auth method
- GitHub App
- Direction
- Read-only
- Sync frequency
- Daily
- Scopes requested
- 4
- Available on
- Growth and Enterprise
- Maintained by
- Urengi
What the GitHub integration does
Three reads that treat the software supply chain as vendor risk.
Dependencies become vendors
Manifests are read per repository, and hosted services behind them are queued for intake. A managed database in a config file is a third party.
Advisories reopen a review
A published advisory against something you depend on reopens that vendor's review, with the affected repositories attached.
Org settings as evidence
Whether 2FA is enforced and who holds owner rights are facts an auditor asks for. Urengi records them rather than asking you to screenshot them.
Exactly what Urengi can see
Four read-only permissions on the repositories you install the app into. Source code is never read.
Urengi reads
- Repository names and visibility
- Dependency manifests and lockfiles
- Organisation membership and 2FA status
- Published security advisories
Urengi writes
- Nothing — this connection is read-only
Urengi never touches
- Source code, diffs or commit contents
- Issues, pull requests or discussions
- Actions secrets or workflow logs
- Anything after you uninstall the app
Connect it in four steps
One authorisation, one field mapping, and a test sync you run yourself.
01
Authorise the connection
Open GitHub from this page and approve the scopes listed above — OAuth in a browser tab, or a scoped API key you paste. An admin approves them once.
02
Choose what syncs
Pick the projects, spaces or accounts Urengi should watch. Narrow is fine to start with; widening it later does not re-authorise anything.
03
Map your fields
Match owners, cost centres and tiers to what Urengi already tracks. Defaults arrive pre-filled from the first sync, so most teams change nothing.
04
Run a test sync
Pull one record and check it landed on the right review. The audit entry confirms the mapping before a real vendor is touched.
Your token, your rules.
Urengi stores the GitHub token encrypted at rest under a per-tenant key and never replays it outside the scopes you approved. Revoke the app in GitHub and every Urengi write stops within seconds — the audit log keeps the history, the connection simply ends.
Read the security statement- SOC 2 Type II
- audited annually
- Per-tenant keys
- no shared secrets
- Revocable in GitHub
- one click, no ticket
- EU or US residency
- chosen at signup