GitHub
Use an operator-owned GitHub App and select its installation/repository. Basic issue linking uses Issues read/write; linked PR status needs Pull requests read. GitHub access uses short-lived scoped installation tokens, not a stored personal access token. The configured replay/advisory PR gate additionally needs Checks read/write, Pull requests read/write and Contents read, signed webhook deliveries and a suitable preview URL. Candidate inventory discovery is a separate capability. Actions-based pilot execution has its own trusted adapter and permissions. Enable only what your deployment uses.Linear
Connect workspace OAuth (actor=app) and select the intended team. This is not a personal API-key integration. Issue creation attributes the initiating user; finding assignment can synchronize by member email, including an assignment made before issue creation. Existing installations may require reconnection for issue-write permissions.
Slack
Connect the workspace, select a channel and invite the bot. Required scopes includechat:write, channels:read and groups:read. Accepted findings can notify that channel; notifySlack: false suppresses notification for an ordinary individual submission. Review failures in logs rather than assuming a stored finding was delivered.
Configure your own deployment
Direct Node integrations use deployment-owned client IDs/secrets and the configured public origin. Hosted broker deployments keep provider app credentials at the broker, with tenant-owned workspace/repository selection.
Use configuration for variable names. Register callbacks on your own HTTPS origin; never copy a private deployment’s identity. Grant additional permissions only after reviewing the capability that needs them. Keep secrets outside source files and documentation examples.