Connecting GitHub
Connect a public or private repository without uploading files.
Authorize and select
Use Connect to authorize the GitHub App, then select an accessible repository in the searchable picker. GitHub sign-in and repository authorization are separate permissions.
Add your live website
If you also want website checks, explicitly enter the deployed website address. Hackaiz does not infer a deployment address from your repository. Review the scan settings before starting.
Sign-in is not repository permission
GitHub sign-in establishes your identity. The GitHub App installation separately grants repository access. A signed-in GitHub account may therefore have no readable repository until the installation is authorized. Organization policies can require an owner to approve the installation.
- Use Connect and authorize the GitHub App for the intended account or organization.
- Grant access to the repositories you want to assess.
- Return to the searchable picker and select the correct repository.
Repository missing or authorization interrupted
Check the account that owns the installation, the organization approval state and the repository selection in GitHub. Do not solve an access error by sharing a personal token in a help ticket. A revoked installation or removed repository needs permission restored; signing in again does not necessarily restore it.
Source, deployment and later fixes
The repository describes the branch and commit read during the scan. The live application may use an earlier commit or different environment settings. Enter the live URL explicitly to add external checks. A proposed fix creates a reviewable change; it does not prove the production deployment contains that change.
Example: a header configured in source can still be missing from the deployed response. Conversely, a hosting setting may add a header that is not present in the repository. Compare both evidence types before deciding.
Sources and further reading
These publications describe related practices and standards. They do not certify your platform or imply that Hackaiz executes every documented method.