DAST

Choosing the repository and fields for GitHub issues

• Last updated: November 5, 2026

• Read time: 5 Minutes

Add an action to a connection to set the repository that receives GitHub issues and the fields that Burp Suite DAST fills in.

Adding a GitHub action

Users can't raise GitHub issues through a connection until it has at least one action.

1. Click the settings icon in the top-right corner of the window, then click Integrations.
2. On the GitHub tile, click Edit.
3. For your connection, click Manage actions.
4. Click Add action.
5. Enter a Name of 255 characters or fewer. Use a name that no other action on the connection uses.
6. (Optional) Enter a Description.
7. Select an Owner and a Repository. For details, see Choosing the owner and repository.
8. (Optional) Set the GitHub fields. For details, see Setting optional GitHub fields.
9. Click Save.

Burp Suite DAST checks that GitHub accepts issues in the repository before it saves the action.

Burp Suite DAST ignores case when it compares action names. If the name breaks a rule, then fix the name and save again. Burp Suite DAST shows one of these errors:

• A Name is required error.
• A Name must be 255 characters or fewer error.
• An An action with this name already exists error.

If the action uses the default assignee of the connection, then Burp Suite DAST checks that this person can be assigned GitHub issues in the repository. If not, then the Assignee field shows a <login> can't be assigned issues in this repository. Choose another assignee. error. Select a different assignee for the action, or change the default.

By default, users raise GitHub issues from an action manually. To raise them automatically, add triggers to the action. For more information, see Raising GitHub issues automatically.

Choosing the owner and repository

• Owner - Select the organization or account that owns the repository. If an organization isn't in the list, enter its full name.
• Repository - Search for a private or internal repository of the owner. To use a public repository, enter only its name, such as example-repo. You select the owner separately.

You can't use an archived repository or a repository that has issues turned off. You also can't use the old name of a renamed or moved repository. Search leaves these repositories out. If you enter the name of one, then Burp Suite DAST marks it as unusable.

If the Repository field shows one of these errors, then fix the problem or select another repository:

• A This repository wasn't found, or this token can't read it. error. Check the name, and check that the token has access to the repository.
• A This repository doesn't belong to the chosen owner. error. Select the correct Owner.
• A This repository has been renamed or moved. Choose it again. error. Select the repository under its new name or owner.
• A This repository is archived, so no issues can be raised in it. error. Select a repository that isn't archived.
• A This repository has issues turned off. error. Turn on issues for the repository in GitHub, or select another repository.

Understanding repository labels

Burp Suite DAST marks a repository in the Repository list when it affects who can read your GitHub issues or what they contain:

• (public, anyone can read its issues) - Anyone can read the GitHub issues that Burp Suite DAST raises there. Burp Suite DAST adds no comments when you link or unlink GitHub issues there.
• (internal, everyone in the enterprise can read its issues) - Everyone in your GitHub enterprise can read the GitHub issues, not only the members of the repository.
• (no Write access, labels, assignee and milestone are dropped) - The account of the token doesn't have Write access to the repository. GitHub creates the GitHub issues without labels, an assignee or a milestone. To keep these values, give the account Write access.

Setting optional GitHub fields

After you select a repository, Burp Suite DAST reads its GitHub fields. All fields are optional:

• Labels - Select repository labels to add to every GitHub issue. Burp Suite DAST also adds a severity label and a confidence label.
• Assignee - Select one person that you can assign in the repository. This person replaces the default assignee of the connection. A GitHub issue has a single assignee.
• Milestone - Select an open milestone of the repository.
• Project - Select an open project of the owner. You can set a project only if the owner has open projects and the token can read them.
• Type - Select an issue type that your organization enabled. You can set a type only for a repository that an organization owns.
• Organization issue fields - Enter values for text, number, date, single select and multiple select fields. You can set these fields only for a repository that an organization owns.

Project, Type and select fields appear only when they have values to select in GitHub. To set a missing field, add values to it in GitHub, then edit the action.

For the default assignee of a connection, see Setting a default GitHub assignee.

If Burp Suite DAST raises a GitHub issue but can't add it to the project, then the GitHub issue remains in the repository. Burp Suite DAST does not raise it again and shows no error.

Severity and confidence labels

Burp Suite DAST adds one severity label and one confidence label to every GitHub issue. You can't turn off or rename these labels.

• Severity labels: severity: high, severity: medium, severity: low or severity: info.
• Confidence labels: confidence: certain, confidence: firm or confidence: tentative.

The labels show the severity and confidence of the Burp Suite DAST issue when Burp Suite DAST raises the GitHub issue. This includes any severity that you set. Burp Suite DAST does not update the labels if the severity or confidence changes later.

Editing and deleting a GitHub action

To find the actions of a connection, follow steps 1 to 3 in Adding a GitHub action.

• To edit an action, click it. Change its settings, then click Save.
• To delete an action, click its Delete action icon, then click Delete. You cannot undo a deletion. Deleting an action does not affect GitHub issues that you already raised.

If a field that you saved no longer exists in the repository, then Burp Suite DAST shows a <name> is no longer available for this destination. error. Click Remove next to the field, then save the action.

Fixing an action after a repository moves

If someone renames or transfers a repository in GitHub, then its action stops raising GitHub issues. The action shows a This repository has been renamed or moved. Choose it again. error. To fix this, edit the action and select the repository under its new name or owner.