projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.68k stars 2.51k forks source link

Add ability to use Github Application Authentication for private repos #5334

Open syntacticNaCl opened 4 months ago

syntacticNaCl commented 4 months ago

Please describe your feature request:

We should add the ability to authenticate with the Github API via Github Application authentication to pull from private repos. The current process of using a PAT works but is not ideal for security teams.

This should add the following values to the config for authentication with corresponding environment variables:

Describe the use case of this feature:

Using a PAT to authenticate with the Github API works well for single users but when using nuclei for a team – especially in an automation pipeline – the preferred way is to create a Github App and use it for authentication. This removes the complexity and degraded security of having to manage a "service account" user with it's own login credentials and PAT.

GeorginaReeder commented 4 months ago

Thanks for your feature request @syntacticNaCl , we'll take a look into it! :)