Integrations (Source Code Review)¶
Audience: All client users can view; connecting a provider is a manager/owner action done
in Administration · Where: Settings → Integrations (/settings/integrations).
Overview¶
Integrations link your source-code provider to Canima so testers can do grey-box / white-box security testing — reviewing your actual code, not just the running app. Connecting a repository makes assessments smarter and more thorough.
Supported providers¶
The Integrations page shows a status card for each provider:
Connect via the Canima GitHub App; shows Connected as <account> when linked.
Connect at the organization level to make repositories linkable.
Connect at the organization level to make repositories linkable.
Each card is badged with its connection state:
| State | Meaning |
|---|---|
| Connected | The provider is linked and ready to use. |
| Expired | The stored token needs re-authorizing. |
| Not connected | No link established yet. |
Connecting is done in Administration
Connecting, disconnecting, installing the GitHub App, and configuring issue-tracker writeback are done from the Administration panel — owners/managers see a Manage in Administration link here, while other users see an admin-managed note (a self-serve request flow is coming). This tab in Settings is the read-only status view.
What connecting a repo does¶
When a repository is linked to a project:
- Static analysis (SAST) runs automatically during the code-review stage of the pipeline.
- If GitHub Advanced Security is enabled, CodeQL, Dependabot, and Secret Scanning alerts are pulled in.
- AI agents use source-code intelligence to guide more targeted exploitation testing.
- Only pentest-confirmed vulnerabilities appear in your reports — raw SAST output is used internally to guide testing, not dumped into your deliverable.
You opt a web-app assessment into code review during the Create Assessment wizard (the Source code review toggle) and by linking the repo — see Running an Assessment.
Tips¶
Get white-box coverage
- Connect your provider before launching a web-app assessment you want reviewed white-box — the linkage has to exist for the code-review stage to run.
- Grey-box/white-box testing typically finds issues black-box testing can't (logic flaws, hardcoded secrets, vulnerable dependencies) — worth enabling for critical apps.
- Because raw SAST noise is filtered out, your report stays focused on confirmed, exploitable issues.
Related: Running an Assessment · Settings & Security · Reports