Connect your GitHub repos.
Every advisory hits the queue at 02:30 UTC — the smallest fix that closes it is drafted on a working branch, your CI runs the branch first, and one PR opens per repo once CI is green. Never to the default branch, never with a force push.
Required permissions
Four permissions total. Read the table — every row explains the work that depends on it.
| Permission | Access | Why we need it |
|---|---|---|
| Contents | Read & Write | Reads source to plan the smallest advisory closure; writes one commit on a working branch — never to the default branch and never with a force push. |
| Pull requests | Read & Write | Reads existing PRs and review comments for context; writes the proposed fix as a PR after green CI. |
| Checks | Read | Reads check-run status (GitHub Actions, Buildkite, CircleCI via the Checks API) to gate the PR; never opens a PR while CI is red. |
| Packages | Read | Reads published package metadata and version tags to detect vulnerable dependency versions in lockfiles; never publishes packages. |
GitHub also auto-grants the metadata scope (repo list, default branch, visibility) to every installed App — it is not listed above because it is on by default, not because it was forgotten.
Callback URL
The URL below is what Bracework registers with GitHub for OAuth redirects. It is derived from the APP_URL deploy var — so it matches the domain your team actually visits.
Loading callback URL…
Install the Bracework GitHub App on the org you want covered.
Bracework’s GitHub App is not yet installed by you — clicking the button opens GitHub’s authorization screen. You can pick which repositories to grant access to before you confirm.