Enji GuardGitHub
GitHub App Permissions
Enji Guard uses a GitHub App to work with your repositories. This page explains why, what it can read and write, what it does not do by default, and how to revoke access.
Why Enji Guard uses a GitHub App
Enji Guard connects to GitHub through a GitHub App rather than a personal access token. A GitHub App gives scoped, per-installation, revocable access to the specific repositories you select, with write permissions used only for the enabled GitHub outputs described below.
What Enji Guard may read
On the repositories you select, Enji Guard can read code and metadata for the duration of an audit. Audits run in isolated, ephemeral workspaces that are removed after each task.
What Enji Guard may write (where enabled)
Where you enable it, Enji Guard can:
- Open issues for findings and scheduled improvement work.
- Open pull requests and pull-request branches with proposed changes.
- Comment on issues and pull requests — for example, posting findings or results, or replying when the app is mentioned. Whether a comment is posted depends on the enabled audit or review workflow.
What Enji Guard does not do by default
- Merge pull requests automatically.
- Deploy code automatically.
- Scan repositories you have not selected.
- Use repository access for unrelated accounts.
- Require personal access tokens.
Revoking access
You can uninstall the GitHub App or change which repositories it can access at any time in your GitHub settings. Revoking access stops future use; reports and history already generated are handled as described in the Data Retention & Deletion page.