DAST

Preparing GitHub for Burp Suite DAST

• Last updated: November 5, 2026

• Read time: 3 Minutes

Create a personal access token in GitHub before you add a connection in Burp Suite DAST. Burp Suite DAST uses the token to raise GitHub issues for the Burp Suite DAST issues it finds.

Creating the personal access token

Burp Suite DAST connects to GitHub with a fine-grained personal access token. It raises every GitHub issue and comment as the account that owns the token. To create the token:

1. Create a dedicated GitHub account for the integration. Don't use a person's account.
2. Give the account the Write role on each repository where Burp Suite DAST raises GitHub issues. For details, see Giving the account the Write role.
3. In GitHub, create a fine-grained personal access token for that account.
4. Set the resource owner of the token to the organization that owns the repositories.
5. Give the token access to every repository where Burp Suite DAST raises GitHub issues.
6. Give the token the permissions in the following table.
7. Copy the token and store it securely. You paste it into Burp Suite DAST when you add the connection.

Permission	Access	When you need it
Issues	Read and write	Always. Burp Suite DAST uses it to read and write GitHub issues.
Metadata	Read	Always. GitHub adds this permission for you.
Projects	Read and write	Only if an action adds GitHub issues to a GitHub project.

Giving the account the Write role

In GitHub, give the account that owns the token the Write role on each repository where Burp Suite DAST raises GitHub issues.

If the account doesn't have the Write role, then GitHub creates the GitHub issue but drops the labels, assignee and milestone. GitHub doesn't report an error. Burp Suite DAST flags these repositories when you select one for an action. For details, see Understanding repository labels.

Using managed user accounts

If your organization uses GitHub Enterprise Managed Users, then GitHub logins end in an underscore and the short code of your enterprise. For example, octocat_mydomain. Enter the full login, including this suffix, when you specify any of the following:

• The owner of a repository.
• The assignee of a GitHub issue.
• The reference of an existing GitHub issue.

Checking the token in Burp Suite DAST

When you add a connection, Burp Suite DAST checks the token by reading the account that owns it. The check doesn't test access to any repository, so it can pass for a token that can't reach any repository.

To check repository access, select a repository for an action. Burp Suite DAST reports a missing permission at that point.

Replacing an expired token

A fine-grained token stops working when it expires or when someone revokes it. In this case, Burp Suite DAST shows a Credentials rejected. Check them and try again. error for the connection. Burp Suite DAST holds automatic GitHub issues until you replace the token. To replace the token:

1. Create a new token in GitHub with the same repository access and permissions.
2. In Burp Suite DAST, edit the connection and paste the new token.
3. Save the connection. Burp Suite DAST retries the held GitHub issues immediately.

Troubleshooting GitHub connections

• If you see a Credentials rejected. Check them and try again. error, then the token is wrong, expired or revoked. Create a new token and edit the connection.
• If you see a This repository wasn't found, or this token can't read it. error, then the token has no access to the repository. Give the token access to the repository in GitHub.
• If you see a This repository has been renamed or moved. Choose it again. error, then edit the action and select the repository under its new name.
• If you see an Unexpected response. Try again later. error, then GitHub returned an error or limited the rate of requests. After a rate limit, Burp Suite DAST waits until GitHub resets the limit.