Connect approved GitHub, GitLab or Bitbucket repositories, select the repositories an organisation may assess, and bind scans to the exact revision that triggered them.
Supported workflow
- An organisation administrator connects the provider.
- QFinch records the provider installation or OAuth scope.
- The administrator selects permitted repositories.
- Signed webhooks or CI submissions create exact-revision scans.
- QFinch runs eligible SAST, SCA, IaC and secrets checks according to policy.
- Terminal status and report links return to the provider where supported.
Provider plans and permissions determine whether issues, SARIF or security-event delivery is available. Use least-privilege permissions and rotate provider credentials according to your organisation policy.
CTA: Connect a source provider