Capabilities
Query Tools
Action Tools
What Hiro Cannot Do
- Revoke personal access tokens
- Remove collaborators
- Delete repositories
- Manage webhooks or deploy keys
- Fine-grained permission management
The GitHub integration is primarily read-focused for security posture analysis.
Setup
Connection Method
Hiro connects via a GitHub App, not OAuth or personal access tokens.1
Start connection
In Hiro, go to Settings > Integrations and click Connect to GitHub.
2
Install the GitHub App
You’ll be redirected to GitHub to install the Hiro GitHub App.Choose:
- Which organization to install to
- Which repositories to grant access (all or select)
3
Authorize
Click Install to authorize the app.
4
Verify connection
You’ll be redirected back to Hiro with the connection confirmed.
Investigation Examples
Check branch protection across repos
- Protected repos count
- Unprotected repos with visibility (public/private)
- Protection details for each protected repo
- Security recommendations
Check specific repo
- Required PR reviews (approval count, dismiss stale reviews)
- Status check requirements
- Admin enforcement
- Force push and deletion settings
Query audit logs (Enterprise Cloud only)
- Branch protection changes (
protected_branch.destroy,protected_branch.policy_override) - Repository access changes (
repo.add_member,repo.remove_member) - Token and key creation (
personal_access_token.create,deploy_key.create) - Webhook changes (
hook.create,hook.config_changed) - Secret scanning alerts
Branch Protection
Enabling Protection
Hiro can enable basic branch protection:Audit Log Access
Audit log queries require GitHub Enterprise Cloud. Standard GitHub plans don’t expose the audit log API. If you’re on Enterprise Cloud, Hiro can search:- By GitHub username
- By source IP address
- By action type
- By time range
Troubleshooting
”App not installed”
The GitHub App may need to be installed or reinstalled. Click Connect to GitHub again.”Repository not found”
The app may not have access to that repository. Check the app’s repository access in GitHub settings.Audit log queries failing
Audit log access requires GitHub Enterprise Cloud. Standard GitHub plans don’t have API access to audit logs.Next Steps
Okta
Connect identity management.
AWS
Connect cloud infrastructure.