Skip to content
Start free
Product Demo Pricing Security Docs Changelog Start free

GitHub App permissions

Org admin

The DevGlimpse GitHub App requests read-only permissions. Each one is listed here with the reason it exists.

What the App requests

Metadata (read-only)
Used for the list of repositories the installation covers, with their names and default branches.
Pull requests (read-only)
Used for pull requests, reviews and review comments — the source of cycle time, review latency and PR size.
Contents (read-only)
Used for commit listings only, for throughput. DevGlimpse never fetches file contents or diffs.
Organization Members (read-only)
Used for organization members and teams, so dashboards can group people the way GitHub does.
Deployments (read-only)
Used for deployment records and statuses, to link shipped pull requests to production deploys and calculate DORA metrics.
Actions (read-only)
Used for workflow-run metadata, to recognize production deployments made through GitHub Actions without reading workflow files.
Copilot metrics (read-only)
Used for org-level Copilot usage counts. Org owners must also enable the Copilot metrics policy; until then DevGlimpse skips it. Never code, prompts or conversations.

Deployments and Actions support deploy tracking and DORA metrics. Copilot metrics provides org-level Copilot usage. Existing installations must approve any added permissions; until then, other metrics keep working. Org owners must also enable GitHub’s Copilot metrics policy; a 403 skips the Copilot import cleanly and is a health notice, not an error.

What it never does

  • File contents or diffs. DevGlimpse never reads your code.
  • Repository files, trees or archives.
  • Workflow logs, artifacts or secrets.
  • Any write access: it cannot push, comment, merge or change settings.
  • Your personal GitHub token after sign-in. It is used once and never stored.

How access is granted

An organization owner installs the App and chooses the repositories it covers. Syncing runs on short-lived installation tokens GitHub issues for that installation. Webhooks are signature-verified before anything is processed. Uninstalling the App stops access at once; the workspace then becomes read-only and is deleted after 30 days unless you delete it sooner.

See Security → GitHub access for the full picture.