Start for free

Code Audit

Connect GitHub

Code Audit reads your code through the Inth GitHub App. Connect GitHub once for each organization, then link each repository to the project that owns the code.

An owner or admin of the organization must do these steps.

Connect a repository

  1. In the Dashboard, open Settings > Integrations.
  2. Next to GitHub, select Set up.
  3. Select Connect GitHub.
  4. On GitHub, install the Inth GitHub App and choose the repositories that Inth can read.
  5. Back in Inth, next to GitHub, select Manage.
  6. Select the repository in the Repositories list.
  7. Under Project links, select Link project.
  8. Choose the project that owns the code, then select Link project.

You can also link a repository when you run an audit. Select Set up audit context.

If a repository is not in the list, select Manage access on GitHub. Give the Inth GitHub App access to that repository.

What the GitHub App can do

The App reads repository contents to audit the code. It writes check runs and review comments on pull requests to show the results. It resolves its own review threads after a change removes a finding.

The App also asks for write access to contents and pull requests. GitHub shows each permission on the install screen.

Add policy pages

Policy pages tell Code Audit what your product promises about data. Code Audit compares the code with those promises. Inth reads policy pages from the website linked to the project.

  1. In the Dashboard, open Audit, then select Run audit.
  2. Under What to audit, select Inth Code Audit.
  3. Under Repository, choose the repository.
  4. Select Set up audit context. If the repository already links to a project, the button is Edit audit context.
  5. Under Policy context, find the project.
  6. If the project has no website, select Add domain.
  7. Select Add policy pages or Edit policy pages.
  8. Enter the URLs of your privacy policy, cookie policy, terms, or subprocessor list.
  9. Select Save policy pages.

If you add no policy pages, Inth finds them on the website by itself. Keep the URLs current.

Next, run a full audit or turn on pull request scans.