GitHub-scoped access
Repository access is resolved through GitHub. Private repositories are limited to repositories made available to the installed GitHub integration.
Security & GitHub access
Clear about what GSkout accesses and what it analyzes.
Public repositories can be analyzed by repository URL. Private repository access is determined by GitHub authentication and the repositories made available to the configured GitHub App installation.
Selective source loading
GSkout uses repository-tree selection and supported file rules instead of blindly loading every file into source analysis.
No installation tokens in reports
Analysis results may expose repository metadata and access type, but GitHub installation credentials are not included in repository reports.
Secret evidence is masked
When a credential-like value is detected, GSkout redacts or partially masks evidence rather than returning the full secret as finding text.
Private repository boundaries
Authentication alone does not grant access to every private repository. Availability depends on the repositories selected for the GitHub App installation.
Focused security analysis
GSkout analyzes supported JavaScript, TypeScript and selected configuration patterns. It does not claim complete verification of every possible vulnerability.
Public repositories
A supported public GitHub repository can be submitted by URL or owner/name. Authentication is not required purely to access publicly available repository content.
Private repositories
GSkout uses the configured GitHub integration to resolve access. Users can only analyze private repositories that are exposed by the relevant installation.
GitHub integration detailsAnalysis does not mean certification.
GSkout reports what its supported analyzers can observe from available repository content.
A clean report does not guarantee that a repository is vulnerability-free. Runtime behavior, infrastructure, unsupported languages, business logic and code outside the selected analysis scope can contain risks that GSkout does not evaluate.
GSkout V1 scope
GSkout V1 is currently designed around Node.js and JavaScript repositories containing a package.json. The security engine is a focused repository- intelligence layer rather than a full formal security audit.