Integrations (Source Code Review)¶
Audience: All client users can view; connecting a provider is a manager/owner action ·
Where: owners and managers: Administration → Integrations; members and viewers:
Settings → Integrations (/settings/integrations, read-only).
Overview¶
Integrations link your source-code provider to Canima so testers can do grey-box / white-box security testing — reviewing your actual code, not just the running app. Connecting a repository makes assessments smarter and more thorough.
Supported providers¶
The Integrations page shows a status card for each provider:
Connect via the Canima GitHub App. When linked, the card shows Connected via the GitHub
App on <account> (or Connected as <account> for a user-level connection).
Connect at the organization level to make repositories linkable.
Connect at the organization level to make repositories linkable.
Each card is badged with its connection state:
| State | Meaning |
|---|---|
| Connected | The provider is linked and ready to use. |
| Expired | The stored token needs re-authorizing. |
| Not connected | No link established yet. |
Connecting is done in Administration
Connecting, disconnecting, installing the GitHub App, and releasing queued writebacks are done
from Administration → Integrations. Owners and managers who open
/settings/integrations are sent there. Members and viewers see a read-only list of the
organization's connections ("Connections are managed by your organization's owners and
managers"); a provider with no link reads "No active connection. Ask an owner or manager to
connect … in Administration."
What connecting a repo does¶
When a repository is linked to a project:
- Static analysis (SAST) runs automatically during the code-review stage of the pipeline.
- If GitHub Advanced Security is enabled, CodeQL, Dependabot, and Secret Scanning alerts are pulled in.
- AI agents use source-code intelligence to guide more targeted exploitation testing.
- Only pentest-confirmed vulnerabilities appear in your reports — raw SAST output is used internally to guide testing, not dumped into your deliverable.
Using a repo in an assessment¶
You opt a web-app assessment into code review in the Create Assessment wizard. Turn on Source code review, then pick the repository to link. With a GitHub repo linked you also choose a GitHub writeback mode — what happens with confirmed findings. Turning on code review with a repo linked selects Auto unless you've already picked another mode:
| Mode | Behavior |
|---|---|
| Disabled | Don't post anything to GitHub. |
| Preview | Queue writebacks for review; an admin releases them from Administration. |
| Auto (recommended) | Post confirmed findings to GitHub immediately when the report finalizes. |
See Running an Assessment for the rest of the wizard.
MSSPs and pentest firms
Source-code connections belong to each client organization, not the firm. At the firm level the page reads "Source code connections are configured per client. Open a client to see its connections." — open the client (Clients → the client → Administration → Integrations) to connect its repositories. See For MSSPs & Pentest Firms.
Tips¶
Get white-box coverage
- Connect your provider before launching a web-app assessment you want reviewed white-box — the linkage has to exist for the code-review stage to run.
- Grey-box/white-box testing typically finds issues black-box testing can't (logic flaws, hardcoded secrets, vulnerable dependencies) — worth enabling for critical apps.
- Because raw SAST noise is filtered out, your report stays focused on confirmed, exploitable issues.
Related: Running an Assessment · Settings & Security · Reports