> ## Documentation Index
> Fetch the complete documentation index at: https://docs.backline.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Integration

> Connect your GitHub repositories to Backline

## Overview

Backline's GitHub integration enables secure, automated pull requests directly in your repositories, streamlining vulnerability remediation through our GitHub App.

## What You Can Do

With the GitHub integration, Backline can:

* Access your repositories across multiple organizations
* Analyze code dependencies and packages
* Create pull requests with automated security fixes
* Track remediation status across your GitHub projects

## Prerequisites

Before connecting GitHub, ensure you have:

* A GitHub account with appropriate permissions
* Admin access to the repositories you want to connect
* Organization owner rights to install the Backline app (if you don't have them, see [Requesting Installation](#requesting-installation) below)

## Connecting GitHub

<Steps>
  <Step title="Navigate to Integrations">
    In Backline, go to the Integration Hub from the main menu.
  </Step>

  <Step title="Select GitHub">
    Find and click on the GitHub integration card.
  </Step>

  <Step title="Install Backline App">
    Click **Connect** to be redirected to GitHub to install the Backline app.
  </Step>

  <Step title="Choose Organization">
    On GitHub, select the target organization where you want to install the Backline app.
  </Step>

  <Step title="Select Repositories">
    Choose **All repositories** or select specific repositories you want to link to Backline.
  </Step>

  <Step title="Complete Installation">
    Complete the installation process. You'll be automatically redirected back to Backline with GitHub connected.
  </Step>
</Steps>

## Requesting Installation

If you don't have organization owner rights, you can submit an installation request. A GitHub organization owner will need to approve it — once they do, Backline automatically completes the integration without any further action from you.

<Steps>
  <Step title="Navigate to Integrations">
    In Backline, go to the Integration Hub from the main menu.
  </Step>

  <Step title="Select GitHub">
    Find and click on the GitHub integration card.
  </Step>

  <Step title="Request Installation">
    Click **Connect**. On the GitHub page, select the organization and click **Request** instead of Install.
  </Step>

  <Step title="Authorize Backline">
    You'll be redirected back to Backline and then prompted to authorize Backline to identify your GitHub account.
  </Step>

  <Step title="Pending State">
    The integration will appear as **Pending** in the Integration Hub. No further action is needed from you.
  </Step>

  <Step title="Automatic Activation">
    Once a GitHub organization owner approves the request, the integration status updates to **Connected** automatically.
  </Step>
</Steps>

<Note>
  The GitHub organization owner does not need a Backline account to approve the request — they approve it directly in GitHub.
</Note>

## After Connection

Once connected, Backline will:

1. Index your repositories
2. Generate remediation plans for vulnerabilities from those repositories
3. Create pull requests for automated fixes

## Configuration

The GitHub integration includes additional configuration options accessible from the **Configuration** tab in the integration modal.

### Dependabot Scan

Backline can ingest vulnerability alerts from GitHub Dependabot, allowing you to centralize SCA (Software Composition Analysis) vulnerabilities alongside findings from other security scanners.

<Steps>
  <Step title="Open GitHub Configuration">
    In the Integration Hub, click **Configure** on the GitHub integration card and navigate to the **Configuration** tab.
  </Step>

  <Step title="Enable Dependabot Scan">
    Check the **Enable Dependabot Scan** checkbox to activate Dependabot alert ingestion.
  </Step>

  <Step title="Save Configuration">
    The setting is saved automatically. Backline will begin scanning for Dependabot alerts.
  </Step>
</Steps>

Once enabled, Backline will:

* Scan all repositories configured for the Backline GitHub App that have Dependabot Alerts activated
* Import SCA vulnerabilities detected by Dependabot into Backline
* Track and deduplicate vulnerabilities across your repositories
* Enable remediation workflows for imported Dependabot findings

<Note>
  Dependabot Alerts must be enabled in your GitHub repository settings for Backline to ingest them. See the [Dependabot integration](/integrations/dependabot) page for more details.
</Note>

## Managing the Integration

### Adding Multiple Organizations

You can connect multiple GitHub organizations to Backline:

<Steps>
  <Step title="Open Integration Details">
    Go to the GitHub integration card in the Integration Hub and click **Configure** to open the integration details.
  </Step>

  <Step title="Add Connection">
    At the bottom of the integration details, click the **Add Connection** button.
  </Step>

  <Step title="Install for New Organization">
    You'll be taken to GitHub to add a new organization. Follow the same installation process to connect another organization.
  </Step>
</Steps>

All connected organizations will be displayed in the integration details page.

### Testing Connections

To verify that a connection is still valid:

1. Open the integration details by clicking **Configure** on the GitHub integration card
2. Find the organization card you want to test
3. Click the **three dots menu** on the organization card
4. Select **Test Connection** to check if the connection is valid

### Disconnecting

To disconnect a GitHub organization:

<Steps>
  <Step title="Open Integration Menu">
    In the Integration Hub, click the **three dots menu** on the GitHub integration card.
  </Step>

  <Step title="Select Disconnect">
    Click the **Disconnect** option from the menu.
  </Step>

  <Step title="Uninstall on GitHub">
    You'll be taken to GitHub where you can uninstall the Backline application.
  </Step>

  <Step title="Confirm Disconnection">
    Once you return to Backline, refresh the page to see that the connection to the GitHub organization was disconnected.
  </Step>
</Steps>

<Warning>
  Disconnecting will stop all automated remediation activities and prevent new vulnerability scanning for that organization.
</Warning>