GitHub integration
Prioritize GitHub CodeQL and Dependabot alerts by adding exploit context to each finding.
Integration details
Primary category
Workflow & Collaboration
Sync direction
GitHub ↔ Konvu
Findings are ingested from GitHub into Konvu. What Konvu writes back to GitHub depends on the integration.
Status
Available
What is GitHub?
GitHub provides code hosting, CodeQL-powered SAST scanning, Dependabot SCA, and issue tracking in a unified DevOps platform.
Why connect GitHub to Konvu
- Triage GitHub Security Advisories and CodeQL alerts based on exploitability analysis, not just severity labels.
- Focus code review on PRs that introduce exploitable vulnerabilities versus theoretical risks.
- Link GitHub Issues to evidence-backed triage decisions for audit trails in your project boards.
How it works
Scan
GitHub produces findings from scans or assessments.
Ingest & enrich
Konvu ingests those findings and enriches them with code, configuration, and deployment context.
Assess exploitability
Konvu determines exploitability and recommended action with evidence attached.
Record decisions
Konvu records each verdict with its evidence. What it can write back to GitHub depends on the integration.
Quick setup
Configure GitHub from the integrations list in Konvu.
- 1Go to /configuration/integrations in Konvu and choose GitHub.
- 2Authorize access and confirm the data sources you want to sync.
- 3Save the configuration to start syncing.
Sync direction
GitHub ↔ Konvu
Findings are ingested from GitHub into Konvu. What Konvu writes back to GitHub depends on the integration.
More integrations
View all
GitLab
Add exploitability analysis to GitLab's built-in SAST and SCA pipeline findings.
- SCA
- SAST
- Ticketing & Messaging
Arnica
Add exploitability verdicts with evidence to Arnica SCA and SAST findings, and send approved SCA dismissals back to Arnica.
- SCA
- SAST
- ASPM
Black Duck
Get an exploitability verdict with evidence for Black Duck Polaris SCA findings and Coverity SAST findings.
- SCA
- SAST
Checkmarx
Send Checkmarx One SCA and SAST results to Konvu for an exploitability verdict with evidence, through the Konvu API or a report upload.
- SAST
- SCA
Semgrep
Find out which Semgrep Supply Chain and Semgrep Code findings are exploitable, with the evidence behind each verdict.
- SAST
- SCA
Snyk
Find out which Snyk Open Source and Snyk Code findings are exploitable in your code, with the evidence behind each verdict.
- SCA
- SAST
- Container Security