Install the Bracework GitHub App
Bracework runs once a night, drafts the smallest fix for each advisory on the lockfiles it can reach, and only opens a pull request once your CI turns green. Installing the App grants the four permissions below — each maps to one specific thing we do, and nothing more.
What we ask for, and why
Four permissions total. Read the table — every row explains the work that depends on it.
| Permission | Access | Why we need it |
|---|---|---|
| Repository contents | Read & write | Open, edit, and commit fix PRs in your repos. |
| Pull requests | Read & write | Read PR context and push fix branches back as PRs. |
| Checks | Read & write | Read CI run outcomes for the PRs we open and update status on advisory fixes. |
| Metadata | Read | Identify the repos you install on so Bracework only scans code you’ve granted. |
Callback URL
The URL below is what Bracework registers with GitHub for OAuth redirects. It is derived from the APP_URL deploy var — so it matches the domain your team actually visits.
OAuth callback URL
This is the URL registered with your GitHub App — it must match exactly on github.com/apps/bracework.
Loading callback URL…
Ready to install
Authorise the App and finish setup on GitHub.
Bracework’s GitHub App is not yet installed by you — clicking the button opens GitHub’s authorization screen. You can pick which repositories to grant access to before you confirm.