Connected directly
GitHub: Who can do what in the code? Complass knows.
Members, teams and permissions for access reviews, plus settings such as required 2FA as evidence.
How it works
- Create a GitHub app
You create your own GitHub app with read permissions only and install it on your organisation.
- Check the preview
The first run is a preview. Nothing is stored until you adopt it.
- Sync regularly
After that Complass syncs daily, or every six hours or weekly if you prefer.
- Review access
Members and rights appear in access reviews. You match people once by hand, because Complass reads no e-mail addresses.
Which data is exchanged
| Direction | Data | Note |
|---|---|---|
| GitHub → Complass | Members with role and 2FA status, outside collaborators, teams with members and repositories | Owners count as privileged. |
| GitHub → Complass (optional) | Direct repository rights from write access upwards | At most 2,000 repositories per run. |
| GitHub → Complass (evidence) | Only switches and figures, such as required 2FA, number of owners, branch protection, secret scanning, push protection and Dependabot | No alert contents and no secrets. |
| Complass → GitHub | Nothing | Complass refuses apps with write or admin permissions. |
| Not read | Code, issues, pull requests, secrets, e-mail addresses, real names, avatars and the audit log | Complass does not request this data at all. |
Setup
- Your own GitHub app, installed on exactly one organisation on GitHub.com.
- Read permissions on members, organisation administration and repository metadata. Repository administration only for direct rights and settings such as branch protection.
- In Complass you enter the organisation, app ID, installation ID and the app's private key.
- Administrators with the right for API, webhooks and integrations can set it up.
Security and data protection
- Read only: Complass checks the app's permissions on every test and refuses write and admin permissions.
- The private key is stored encrypted in Complass. Each run creates a token valid for at most one hour, in memory only.
- Complass only connects to the GitHub API.
- Only active repositories count for evidence. With the topic "complass-ignore" you leave a repository out.
Frequently asked questions
Does it work with GitHub Enterprise Server?
No, only with organisations on GitHub.com.
We have several organisations. What now?
One connection covers exactly one organisation.
Can Complass read our code?
No. The app needs no permission on contents, and Complass requests neither code nor issues or pull requests.
More connections
Which packages include the connection to GitHub, see the package overview. See the packages
Product names and trademarks belong to their respective owners. There is no partnership, certification or endorsement by the owners. GitHub is a trademark of GitHub, Inc.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.