Using VIfix
Scanning GitHub repos
VIfix uses your own GitHub token to download a repository to your machine, scan it, and delete it afterwards.
Create a token#
Open GitHub token settings
In VIfix, go to GitHub Repositories and click Create token. It opens GitHub's fine-grained token page with the name and permissions filled in.
Choose repositories
Limit the token to the repositories you want to scan.
Paste it into VIfix
Copy the token, paste it in the app and click Connect. VIfix verifies it and lists your repos.
Permissions#
| You want to… | Token permissions |
|---|---|
| Scan repos | Contents: Read · Metadata: Read |
| Also open fix pull requests | Contents: Read and write · Pull requests: Read and write |
| Add a security label to PRs (optional) | Issues: Read and write |
Note
The token is encrypted with your operating system's keychain and never shown to the app's interface. VIfix only displays your GitHub username.
Connect and scan#
Pick a repository and branch, then click Run scan. Results appear exactly like a local scan. From a finding you can commit a fix as a pull request.
How repo scans work#
- VIfix downloads a tarball of the branch instead of cloning, so no Git install is needed and the token never lands in a remote URL or
.git/config. - Only regular files and folders are extracted (no symlinks), capped at 300 MB.
- The temporary folder is deleted as soon as the scan finishes.