Overview
Github App Integration
Connect the GitHub App to Sprinto to automatically monitor repositories, access controls, and security checks for continuous compliance.
The GitHub App integration enables Sprinto to continuously monitor your GitHub organisation for repository activity, access controls, and security configurations.
Sprinto uses this integration to automate compliance checks such as:
- Multi-factor authentication (MFA) enforcement
- Repository access reviews
- Branch protection and peer review enforcement
- Dependabot vulnerability monitoring
The integration supports two connection methods:
- Sprinto GitHub App (recommended) — Quick setup using Sprinto’s pre-configured app
- Bring Your Own GitHub App — Custom setup for enterprise or restricted environments
How it Works
The integration uses GitHub Apps with read-only permissions to securely fetch compliance data.
- You initiate the connection from Sprinto.
- You choose a connection method.
- GitHub permissions are granted at the organisation level.
- Sprinto generates installation access tokens.
- Data is retrieved using GitHub REST and GraphQL APIs.
- Controls and checks are continuously evaluated.
Note
The integration relies on read-only GitHub App permissions aligned with Sprinto’s production configuration to ensure secure and non-intrusive access.
Sprinto checks for GitHub
The below procedure below has a dedicated section for configuring GitHub as a change management and ticketing system. You can follow the section that applies to your GitHub Usage:
| Sprinto check | Check description | Reference procedure |
|---|---|---|
| GitHub org level MFA should be enforced | Multi-factor authentication (MFA) should be enforced at the organization level. | How to fix |
| GitHub user should have MFA enabled | Multi-factor authentication (MFA) should be enabled on all users' accounts | How to fix |
| Github access should be removed for offboarded user | Revoke access from the organization’s GitHub account for every offboarded staff member. | How to fix |
| Dependabot vulnerability scan should be enabled | Enable the Dependabot vulnerability scan on your GitHub repositories. | How to fix |
| Peer review should be enforced for code changes | Peer review should be enforced on every change merging request on the main branch. | How to fix |
| Merging of code changes should require passing status-checks | Every code change must pass the status check. | How to fix |
| Branch Protection rules should be enforced for admins | The branch protection ruleset should be configured on the GitHub account. | How to fix |
| Code changes should be reviewed by peers before merging | Every code change should be reviewed by a peer reviewer. | How to fix |
Supported GitHub Environments
Sprinto supports integration with:
- GitHub Cloud (github.com)
- GitHub Enterprise Cloud (*.ghe.com)
- GitHub Enterprise Server (self-hosted)
Use Bring Your Own GitHub App for enterprise or data residency requirements.
Required Permissions
To align with Sprinto’s production GitHub App configuration, grant the following read-only permissions:
Repository Permissions
- Metadata — Read-only
- Administration — Read-only
- Checks — Read-only
- Dependabot alerts — Read-only
- Pull requests — Read-only
Organisation Permissions
- Administration — Read-only
- Members — Read-only
These permissions allow Sprinto to monitor repository activity, access configurations, and security posture without making any changes.
What Data Sprinto Accesses
Sprinto retrieves the following data:
- Installation ID
- Organisation details
- Repositories and branches
- Commits and pull requests
- Organisation members and collaborators
- MFA status
- Dependabot vulnerability alerts
APIs Used by Sprinto
Sprinto uses GitHub APIs to retrieve compliance data securely.
REST API Endpoints
| Endpoint | Purpose |
|---|---|
| GET /app | Validate app credentials |
| GET /app/installations/{installationId} | Retrieve installation details |
| POST /app/installations/{installationId}/access_tokens | Generate access tokens |
| GET /orgs/{org} | Fetch organisation details |
| GET /orgs/{org}/members | List organisation members |
| GET /orgs/{org}/outside_collaborators | List external collaborators |
| GET /orgs/{org}/repos | List repositories |
| GET /users/{username} | Fetch user details |
| GET /repos/{owner}/{repo}/pulls | Retrieve pull requests |
GraphQL API
Sprinto also uses GitHub’s GraphQL API (https://api.github.com/graphql) to:
- Query organisation members with roles
- Retrieve SSO/SAML identity information
- Fetch commit history and pull request data
- Access vulnerability and security alerts
Important Considerations
- Selecting specific repositories limits monitoring scope.
- Missing repositories are usually due to restricted selection.
- Reinstallation is required to update repository access.
Before you begin
Ensure the following prerequisites are met:
- You have Admin access to the GitHub organisation where the app will be installed.
- You are logged in to the Sprinto Admin Portal.
- Your GitHub organisation allows third-party GitHub Apps to be installed.
How it works
The integration works in three stages:
- You initiate the connection from Sprinto.
- You install the Sprinto Audit GitHub App in your GitHub organisation.
- Sprinto syncs repository and organisation-level data to automate compliance checks.
The connection type used is OAuth.
Dashboard Actions
Connect GitHub App
- Log in to the Sprinto dashboard.
- Navigate to Settings → Integrations.
- In the All tab, search for GitHub App.
- Click Connect.
- Review:
- Controls automated
- Checks covered
- Permissions required
- Data accessed by Sprinto
- Click Next.
Choose Authentication Method
Option 1: Use Sprinto’s GitHub App (Recommended)
Use Sprinto’s pre-configured GitHub App for a quick setup.
- Select Use Sprinto’s GitHub App.
- Click Connect with Sprinto.
- You will be redirected to GitHub.
- Sign in and authorise the Sprinto Audit app.
- Select:
- Organisation
- Repository access (All or Selected)
- Click Install.
After installation:
- You are redirected back to Sprinto
- Initial sync begins automatically
- Integration status updates to Active
Option 2: Bring Your Own GitHub App
Use this method for GitHub Enterprise or custom configurations.
Step 1: Create a GitHub App
- Select Bring Your Own GitHub App.
- Click Continue.
- In your Github account, go to Settings → Developer settings → GitHub Apps.
- Click New GitHub App.
- Enter:
- App name: sprinto-audit-app
- Homepage URL:
Use your Sprinto region: - Callback URL:
Use your Sprinto region: - Setup URL (Post Installation):
- Configure the required permissions.
- Click Create GitHub App.
- After creation:
- Note the App ID
- Copy the Public Link
- Scroll down to the Private Keys section.
- Click Generate a private key.
Configure IP Allowlist (Required)
After creating your GitHub App, you must allow Sprinto’s public IP addresses if your organisation enforces IP restrictions.
Add the following IP addresses to your allowlist based on your Sprinto region:
| Region | Domain | Public IP |
|---|---|---|
| US | app.sprinto.com | 54.193.221.51 |
| India | in.sprinto.com | 3.108.123.60 |
| EU | eu.sprinto.com | 18.184.125.204 |
| AU | au.sprinto.com | 54.252.98.100 |
Important
Ensure these IP addresses are added to your organisation’s IP allowlist to enable successful communication between Sprinto and GitHub.
Step 2: Add Credentials in Sprinto
- Enter:
- App Public Link
- App ID
- Private Key
- Click Test Connection.
- Once validated, click Connect.
- You will be redirected to GitHub, select the user to authorise your GitHub app.
- Click Continue.
- Click Install to install your app.
Sprinto will establish the connection and begin syncing data.
Complete integration
After installation:
- You will be redirected back to Sprinto.
- Sprinto will initiate the initial sync.
- The GitHub App status will update to Active once connected.
The integration is now complete.
Troubleshooting
- Unable to install the app
- Ensure you have organisation admin access in GitHub.
- Check whether your organisation restricts third-party app installations.
- Integration shows inactive
- Confirm the app is installed in the correct organisation.
- Verify repository access selection.
- Try reconnecting from Settings → Integrations.
- Missing repositories in Sprinto
- If “Only select repositories” was chosen, ensure the required repositories were selected.
- Reinstall the app and modify repository access if needed.
Support
Contact Sprinto support if you have any queries regarding the integration or need any assistance.