Scan GitHub for secrets

Connect GitHub as a data source to HCP Vault Radar to scan your GitHub repositories for sensitive data and secrets. Vault Radar supports scanning GitHub Cloud and GitHub Enterprise Server.

If you are new to HCP Vault Radar, checkout the HCP Vault Radar quickstart series.

Prerequisites

HCP IAM user with the HCP owner, or admin role
Vault Radar agent deployed and running (agent scan only)

GitHub personal access token with the following permission scopes:

repo > all
admin:org > read:org
admin:repo_hook > all
admin:org_hook > all
user > read:user

Add a GitHub data source

You can add and scan GitHub Cloud or GitHub Enterprise Server using the HCP Vault Radar cloud scan or HCP Vault Radar agent scan.

Note

Vault Radar has a limit of 5000 repositories per connection. If you have more than 5000 repositories, Vault Radar will select the 5000 repositories with the most recent activity.

Add GitHub Cloud as a data source to scan your GitHub organization's repositories for secrets.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select HCP Vault Radar Scan.
Select GitHub Cloud.
Enter the personal access token in the Enter your GitHub personal access token field.
Click Next.
Select either All data sources or Select data sources.
Click Finish

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select Vault Radar Agent Scan.
Select GitHub Cloud.
Enter the path to the environment variable with the personal access token in the Enter environment path to your GitHub personal access token field.
Example:
```
env://GITHUB_TOKEN
```
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Add GitHub Enterprise Server as a data source to scan your GitHub organization's repositories for secrets.

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select HCP Vault Radar Scan.
Select GitHub Enterprise Server.
Enter the following information:
- Enter your GitHub domain name: Fully qualified domain name of your GitHub Enterprise Server.
- Enter your GitHub personal access token: Access token from your GitHub Enterprise Server.
Click Next.
Select either All data sources or Select data sources.
Click Finish

Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.
Click Vault Radar.
Click Settings.
Click Data Source Hosts.
Click Add data source host.
Select Vault Radar Agent Scan.
Select GitHub Enterprise Server.
Enter the following information:
- Enter your GitHub domain name: Fully qualified domain name of your GitHub Enterprise Server.
- Enter environment path to your GitHub personal access token: Access token from your GitHub Enterprise Server.
Example:
```
env://GITHUB_TOKEN
```
Click Next.
Select either All data sources or Select data sources.
Click Finish.

Assign a group to a resource

Once you add a data source, an HCP user with the admin role must assign a group to each of the monitored resources within each data source. You can assign each resource to only one group.

Note

Users with the HCP IAM admin role do not need to be a member of other groups. Accounts with the admin role have full access to Vault Radar.

If you do not already have a group, refer to the Identity and Access Management groups documentation to create a group.

Navigate to the Project dashboard.
Click Access control (IAM).
Click Add new assignment.
Search the name of the group in the Search for an assignee search field.
Click the group name in the search results.
Click the Select service pulldown menu and select Vault Radar.
Click the Select role pulldown menu and select the Vault Radar Developer role.
Click Save.
Click Back to Dashboard.
Click Vault Radar.
Click Resources.
Select the resource you want to assign to a group and click Assign groups.
Click the Assign resoruce to group pulldown menu.
Select the group that requires access to the resource.
Select either the Viewer or Contributor role.
Click OK.

Update data source host

Navigate to Settings.
Click Data Source Hosts
Click the vertical ellipsis to the right of the data source host.
To update the monitored data sources, click Edit data sources.
To update the token, click Edit data source host details.
To delete the data source host, click Delete data source host.

Tutorials

Learn how to evaluate and implement HCP Vault Radar in your environment with our tutorials.

HCP Vault Radar quickstart - Follow HashiCups, a fictitious coffee company, as they onboard HCP Vault Radar and scan their data sources for secrets.
HCP Vault Radar operation - Learn how HashiCups uses HCP Vault Radar advanced features to scan data sources with the Vault Radar agent, and correlates findings with HCP Vault to manage secrets.