projectdiscovery / nuclei

Fast and customizable vulnerability scanner based on simple YAML based DSL.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.15k stars 2.47k forks source link

Add ability to use Github Application Authentication for private repos #5334

Open syntacticNaCl opened 3 months ago

syntacticNaCl commented 3 months ago

Please describe your feature request:

We should add the ability to authenticate with the Github API via Github Application authentication to pull from private repos. The current process of using a PAT works but is not ideal for security teams.

This should add the following values to the config for authentication with corresponding environment variables:

Describe the use case of this feature:

Using a PAT to authenticate with the Github API works well for single users but when using nuclei for a team – especially in an automation pipeline – the preferred way is to create a Github App and use it for authentication. This removes the complexity and degraded security of having to manage a "service account" user with it's own login credentials and PAT.

GeorginaReeder commented 3 months ago

Thanks for your feature request @syntacticNaCl , we'll take a look into it! :)