ONCyber Secrets Scanner — Installation Guide

What this is

ONCyber's secrets in code scanning service

The ONCyber Secrets Scanner is a GitHub App that authenticates ONCyber's vulnerability detection tooling against your repositories with strictly read-only access. It replaces ad-hoc, credential-based scanning with an auditable, scoped, revocable mechanism that aligns with modern security best practices.

Findings are correlated, deduplicated, and triaged through ONCyber's PatchPro platform, then delivered to your team.

Why a GitHub App rather than a personal access token?

Personal tokens tie scanning to an individual's account, expire silently, and grant broad access. A GitHub App is owned by ONCyber, scoped to exactly the repositories you authorize, fully audit-logged, and revocable by your organization owners at any time without coordinating with us.

Permissions

What the App can and cannot do

All permissions requested are read-only. The App cannot modify your repositories, settings, or any data in your GitHub organization.

Permissions requested

Repository Contents

Read source code and commit history to detect exposed secrets.

contents: read

Metadata

Enumerate which repositories exist in the organization.

metadata: read

Pull Requests

Scan unmerged code in open pull requests for early detection.

pull_requests: read

Secret Scanning Alerts

Read GitHub's native secret scanning findings to correlate and deduplicate.

secret_scanning_alerts: read

Actions

Inspect workflow files (.github/workflows) for embedded credentials.

actions: read

Capability boundary

The App CAN

Read repository contents and commit history
Read pull request content
List repositories in scope
Read GitHub's secret scanning alerts
Read CI/CD workflow files

The App CANNOT

Write, modify, or delete any code
Change any repository settings
Access Issues, Discussions, Wiki, or Projects
Add, remove, or modify org members
Access repositories you didn't authorize
Push code, open pull requests, or comment

Installation

Install in three steps

The entire installation takes about two minutes. You'll need a GitHub user account with Owner permissions on your organization.

Step 1

Open the installation URL

Visit the URL below in a browser where you're already signed into GitHub as an organization owner:

Installation URL

https://github.com/apps/oncyber-secrets-scanner/installations/new

Install on GitHub

Note from ONCyber This is intended for existing PatchPro or PentestPro customers, if you are not an ONCyber customer visit us today at www.oncyber.ca.

Step 2

Choose the organization and repository scope

If GitHub asks which account to install on, select your organization (not a personal account).

You'll then choose between two repository access modes:

All repositories (recommended)

New repositories auto-enroll in scanning
No coordination required as your codebase grows
Best for ongoing, continuous coverage

Only select repositories

You hand-pick which repos are scanned
New repositories require manual addition
Best for phased rollouts or restricted scope

Step 3

Review permissions and confirm

GitHub presents a summary of permissions before final installation. Review them, they should match the list in the previous section, then click Install.

You'll be redirected to a confirmation page. Installation is complete.

Notify ONCyber Reply to your ONCyber contact's email with a brief "Installation complete" so we can verify on our side and schedule the first scan. We do not receive an automatic notification.

After installation

What happens next

Within 4 hours

ONCyber confirms the installation is detected on our side and validates repository access scope.

Within 24 hours

First baseline scan begins. Larger repository sets (50+ repos with extensive history) may take longer to complete.

Within 72 hours

Initial findings report delivered through PatchPro, with severity-ranked remediation guidance.

Ongoing

Scheduled scans on the cadence defined in your engagement (typically weekly), with critical findings escalated within 4 hours of detection.

Control & oversight

You remain in control

Reviewing the App at any time

Visit your organization's installed apps page to see exactly what's installed, what permissions it has, and when it was authorized:

Your installed apps

https://github.com/organizations/<your-org>/settings/installations

Revoking access

Any organization owner can revoke the App's access at any time, with no notice or coordination required:

Navigate to the installed apps page above
Locate ONCyber Secrets Scanner in the list
Click Configure → scroll to the bottom → Uninstall

Revocation is immediate. ONCyber's tooling cannot bypass or delay this action.

Adjusting repository scope

If you initially chose "Only select repositories," you can add or remove specific repositories at any time through the same Configure page. Changes take effect on the next scheduled scan.

Audit log visibility

Every action the App takes is logged in your organization's audit log under the App's name, available at:

https://github.com/organizations/<your-org>/settings/audit-log

Data handling

How ONCyber handles your data

Where data lives

Scanning is executed on ONCyber-managed infrastructure hosted by 1&1 AG, headquartered in Germany. Source code is processed in memory during scanning and is not retained at rest. Only finding metadata — file path, line number, secret type, severity — is persisted for triage and reporting.

Retention

Scan execution logs: retained on ONCyber infrastructure for 12 months for operational and audit purposes
Findings data: retained per the data retention schedule in your Master Services Agreement
Source code: not retained at rest; processed only in memory during active scans

Access controls

The cryptographic credentials used to authenticate the App are stored on ONCyber-managed infrastructure with restricted filesystem permissions, file-level access logging, and encrypted off-site backup. Credentials are rotated on a 90-day schedule.

Frequently asked questions

Common questions from security and DevOps teams

Does this scan private repositories?

Yes. That's the primary purpose. The App scans whichever repositories you grant access to during installation, public or private.

Does it conflict with GitHub Advanced Security or our existing secret scanning?

No. ONCyber's scanner reads (and correlates with) GitHub's native secret scanning alerts where present, but uses a different and broader detection engine. The two are complementary. Findings from both sources are deduplicated in PatchPro before reaching your team.

Will this slow down our CI/CD or repository performance?

No. The App reads via GitHub's standard API on a scheduled cadence, separate from your CI runners. There is no agent installed on your infrastructure and no impact on developer workflows or build times.

What happens if a critical finding is detected?

Critical findings — for example, an active credential committed to a public-facing branch — are escalated to your designated security contact within 4 hours of detection, including remediation guidance. Standard-severity findings are delivered in scheduled reports.

Can we restrict the App to specific branches?

GitHub Apps don't support per-branch permissions; access is granted at the repository level. However, our scanning configuration can be tuned to focus on default branches or to exclude specific paths if needed. Discuss with your ONCyber engagement lead.

Who at ONCyber can see findings about our code?

Findings are accessible only to the ONCyber personnel assigned to your engagement, under the confidentiality terms of your Master Services Agreement. Access is logged and reviewable on request.

What if our legal or procurement team needs additional documentation?

ONCyber can provide the full App permission manifest, SOC2 control narrative, sample findings reports, security questionnaire responses, and standard data processing terms. Contact your engagement lead and we'll route the request appropriately within one business day.

Can we schedule scans for off-hours only?

Yes. Scans run on the schedule defined in your engagement and can be configured for any time window. Default cadence is weekly, run during low-activity hours in your timezone.

What if we need to revoke and re-authorize later?

Uninstalling and reinstalling is supported. Your scan history and findings data are preserved on the ONCyber side for the retention period defined in your MSA. New installations resume scanning on the next scheduled run.