Connect a private GitHub repo

You'll need

Admin on the repo (or org approval)

Time

~5 min

Access

Read-only — code, never write

Connecting a private repository gives Wolfix the full code scan: it reads your stack, API routes, the data types you collect, and your dependencies straight from source. That is what makes generated documents specific to your app rather than generic. Access is always read-only — Wolfix never pushes commits, opens pull requests, or changes anything in your repository.

Choose how to grant access

On the Connect screen, select GitHub and choose one of two methods:

GitHub App (recommended) — install the Wolfix app and pick the exact repositories it may read. Access is scoped per-repo and easy to revoke.
Fine-grained personal access token (PAT) — paste a token you create yourself when you can't install an app, for example on a locked-down org.

The GitHub App is the safer default because the grant is repository-scoped and visible in your org's installed-apps list.

Fig. 01 — Connect screen: choose GitHub App or a personal access token · screenshot pending

Approve the repository scope

If you install the GitHub App, GitHub asks which repositories to share. Select Only select repositories and pick just the repo you want to scan — Wolfix never needs access to your whole account. The only permission it requests is Contents: read-only.

Fig. 02 — GitHub: grant read-only access to a single repository · screenshot pending

Organisation repos may need an owner's approval

If the repository belongs to an organisation, a member can request the install but an organisation owner has to approve it. Until that approval lands, the repo won't appear in Wolfix's picker. Ask an owner to approve the request in your org's Settings → Third-party Access → GitHub Apps.

Clear the SSO authorization (if your org uses SAML)

Organisations with SAML single sign-on require each grant to be authorized for SSO before it can read repository contents. After installing the app — or after creating a fine-grained PAT — open your org's settings and authorize the grant for SSO. If you skip this, the scan returns a permissions error even though the install looks complete.

For a fine-grained PAT specifically:

Create the token at GitHub → Settings → Developer settings → Fine-grained tokens.
Set Resource owner to the organisation that owns the repo.
Under Repository access, choose Only select repositories and add the one repo.
Under Permissions → Repository permissions, set Contents to Read-only — and nothing else.
Save the token, then Configure SSO on it for your org.

Fig. 03 — GitHub: authorize the grant for your organisation's SSO · screenshot pending

Why read-only is enough

Wolfix only needs to read your code to detect your stack and data flows. It requests the minimum scope — read access to repository contents — so even if a token leaked, it could not modify or delete anything.

Select the repo and start the scan

Back in Wolfix, the authorized repository now appears in the picker. Select it, optionally add your live URL for an even richer report, and click Start scan. Wolfix reads the default branch and runs the code scan alongside its other checks.

Fig. 04 — Connect screen: repository selected and ready to scan · screenshot pending

Revoke access any time

You stay in control. Remove the GitHub App from your org's installed-apps list, or delete the fine-grained PAT, and Wolfix immediately loses access. Existing reports are unaffected — they're snapshots, not live connections.

You just did

Your private repo is connected

Chose the GitHub App or a fine-grained personal access token
Scoped access to a single repository, contents read-only
Authorized the grant for SSO where your org requires it
Selected the repo and ran a full code scan