Customer-selected repositories
You choose which repositories Canon can access. Installing a Canon GitHub App for one repository does not grant access to every repository in your organization.
Security
How Canon accesses your repositories
Canon uses GitHub Apps to inspect and govern only the repositories you select. Access is repository-specific, permission-limited, short-lived, and revocable through GitHub.
Canon Verify and the Canon GitHub App (used for Orchestrate and Command) are separate because inspection and enforcement require different levels of authority. Installing Verify does not give Canon permission to change your repository. Installing one app does not install the other.
01
Canon’s repository-access principles
Least privilege
Each app requests only the permissions its function requires. Verify is read-only, enforced in code: every inspection token is minted read-only and checked against what GitHub actually granted, and a token carrying anything beyond read access is refused before use. The Canon GitHub App has write access where the product writes, and each token it uses carries only the permissions of the operation in progress.
Short-lived credentials
Canon uses short-lived GitHub App installation tokens. Canon does not ask customers to create or paste long-lived personal access tokens.
Revocable at any time
Repository owners can suspend or uninstall either app through GitHub. Revocation prevents Canon from performing future inspections or operations.
02
How Canon Verify works
Canon Verify performs a point-in-time inspection of a selected repository and its GitHub configuration.
- 1You install the Canon Verify GitHub App.
- 2You select the repositories Canon may inspect.
- 3GitHub issues Canon a short-lived installation token.
- 4Canon reads the repository’s GitHub control configuration and a bounded set of configuration files.
- 5Canon binds the inspection to a repository, branch, and commit.
- 6Canon generates a verification report and evidence package.
- 7The token expires. Canon does not keep it as a customer credential. If a token must be held between steps, it is encrypted (AES-256-GCM, server-only key) and deleted when used or expired.
The report identifies which controls Canon confirmed, which are partially implemented, which appear to be gaps, and which Canon could not verify with the available access. “Not observed” and “Unable to verify” are not treated as failures.
03
Two apps. Two trust boundaries.
Canon Verify
Purpose: inspect and report.
Verify uses read-only permissions to examine repository configuration, workflows, checks, branch controls, ownership, release configuration, security configuration, and other available SDLC evidence.
Verify cannot
- Push or modify code
- Create or merge pull requests
- Change rulesets or branch protection
- Modify repository settings
- Start deployments or publish releases
- Change workflows
- Read GitHub secret values
Canon GitHub App
Purpose: govern and operate. Used for Orchestrate and Command.
Installed separately when you choose to govern or operate a repository. It writes where the product writes: publishing your approved flow as workflows and agent configuration, opening pull requests, applying rulesets, starting governed runs, and setting the Actions secrets your agents need.
The Canon GitHub App cannot
- Read GitHub secret values (it can set secrets; GitHub never returns their values)
- Access repositories outside the installation
- Let a running workflow mint a token that writes secrets
Verify credentials are never promoted into Canon GitHub App credentials.
Learn about Canon Orchestrate04
GitHub permissions used by Verify
All permissions are read-only. Canon displays the requested permissions before installation.
| GitHub permission | Access | Why Canon needs it |
|---|---|---|
| Metadata | Read | Identify the repository, default branch, visibility, and installation context. |
| Contents | Read | Read configuration files: workflows, CODEOWNERS, dependency manifests, agent configuration, Canon artifacts. |
| Actions | Read | Inspect workflow runs and available automation evidence. |
| Checks | Read | Determine which checks protect changes and whether required controls execute. |
| Pull requests | Read | Inspect review, approval, merge, and change-control evidence. |
| Administration | Read | Inspect rulesets, branch protection, merge settings, and repository controls. |
| Deployments | Read | Inspect deployment history and deployment gates. |
| Environments | Read | Inspect environment protection rules and required reviewers. |
| Code scanning alerts | Read | Confirm code scanning is configured and running. |
| Dependabot alerts | Read | Confirm dependency alerting is configured. |
| Secret scanning alerts | Read | Confirm secret scanning is configured. |
| Members (organization) | Read | Resolve CODEOWNERS entries and required-reviewer teams to real people. |
Not requested: Issues, Secrets, Workflows (write), Webhooks, account or enterprise permissions, event subscriptions.
05
GitHub permissions used by the Canon GitHub App
| GitHub permission | Access | Why Canon needs it |
|---|---|---|
| Metadata | Read | Identify the repository and installation context. |
| Contents | Read and write | Publish your approved flow: agent instructions, rules, and Canon configuration files. |
| Workflows | Read and write | Publish and update the GitHub Actions workflows your flow compiles to. |
| Pull requests | Read and write | Deliver changes as pull requests you review before anything merges. |
| Actions | Read and write | Start governed runs and read their status. |
| Issues | Read and write | Create and update the issues that track governed work. |
| Secrets | Write | Set the Actions secrets your agents need, such as your model provider key. GitHub never returns secret values. |
| Administration | Read and write | Apply the rulesets, branch protection, and repository settings that enforce your flow. |
| Administration (organization) | Read and write | Create repositories when you ask Canon to set one up. |
Tokens are scoped per operation.
Each token carries only what that operation needs:
- Deploying a flow
- Contents, Pull requests, Workflows, Administration
- Starting a run
- Actions, Contents, Issues
- Managing secrets
- Secrets only
06
What Canon examines and records
What Canon examines
Depending on the repository and available GitHub features, Verify may examine:
- Default branch and repository settings
- Branch protection and repository rulesets
- Required checks and their expected source
- GitHub Actions workflows
- Action-version pinning
- Pull-request review requirements
- CODEOWNERS and review authority
- Merge strategies
- Environment protection and deployment gates
- Release and tag controls
- Dependency review
- Code scanning
- Secret scanning configuration
- Dependabot configuration
- Workflow permissions
- GitHub App installations
- AI-agent and automation configuration
- Agent authority and tool access
- Build, test, lint, and validation commands
- Evidence retention and traceability
- Commit, pull-request, release, and deployment relationships
Some GitHub controls require organization-level access, a particular GitHub plan, or additional App permissions. When Canon cannot inspect a control, the report marks it Unable to verify and explains what access or evidence is missing.
What Canon records
Every verification is bound to a specific inspection context:
- Verification ID
- GitHub organization and repository
- Repository numeric ID
- Inspected branch
- Inspected commit SHA
- Inspection date and time
- Canon control-library version
- Controls evaluated and their results
- Evidence collected and evidence-package digest
- Report version
Later repository changes do not rewrite a completed report. A new inspection produces a new verification record. A Canon Verify report is evidence of what Canon could observe at the stated repository state and inspection time. It is not a permanent certification of future repository behavior.
07
Repository content and data handling
Canon does not store repository code. Verify reads a bounded set of configuration files in memory to evaluate controls; Canon stores the file paths, timestamps, and results. Logs, diffs, and build output stay in GitHub.
Canon stores repository metadata, the flows and agents you author, verification results and evidence packages, and execution records.
- Models and your code
- No repository content reaches a model on Canon’s side. Verification is deterministic rule evaluation. Three design-time features use a model, and only on text you type: drafting a flow, authoring an agent, and enhancing an agent. At runtime, agents run in your GitHub Actions under your own provider key. Your code is processed by the model provider you choose, under your key, inside your CI. Canon never sees it.
- Model API keys
- Never stored by Canon. They are sealed with your repository’s public key and handed to GitHub, which is the only party that can open them.
- Hosting
- Canon is operated from the United States. All data is stored and processed in US infrastructure.
- Retention
- Canon retains your data while your account is active. If you cancel, your flows, verification records, and execution history are retained for 30 days so you can reactivate or export, then permanently deleted. You can request deletion at any time, and we complete it within 30 days. Repository code is never stored, so there is nothing to retain.
DPA and questionnaires. A Data Processing Addendum and a completed security questionnaire are available on request: security@strikelabs.co.
Subprocessors, encryption, and full terms are in the Privacy Policy.
08
Report integrity
A formal Canon Verify report should identify the repository and bound commit, the inspection time, the controls Canon evaluated, the evidence supporting each result, controls Canon could not evaluate, the control-library version, a digest for the evidence package, and the verification identifier.
Canon should never describe a control as confirmed when the available GitHub access cannot prove it.
09
Revoking Canon’s access
An organization or repository owner can suspend or uninstall either app from GitHub at any time.
Revoking Canon Verify
- Prevents future inspections
- Invalidates Canon’s ability to request new tokens
- Does not change the repository
- Does not alter completed point-in-time reports
Revoking the Canon GitHub App
- Stops future deployments and governed runs
- Leaves files Canon already published in your repository in place; they’re yours
- Leaves your Actions secrets in GitHub, where you can rotate or delete them
Completed reports remain historical records until deleted under the retention policy above.
Manage installed GitHub Apps10
Verify does not mean certified forever
Software repositories change continuously. Workflows, rulesets, applications, permissions, checks, dependencies, and release processes can change after an inspection.
A Canon Verify report establishes what Canon observed at a defined point in time. It does not guarantee that the repository will remain in that state. Run a new verification after material changes to rulesets, required checks, App installations, workflow permissions, AI-agent authority, production environments, release controls, ownership, or build architecture.
11
Security questions
12
Report a vulnerability
Security researchers and customers may report suspected vulnerabilities to security@strikelabs.co.
Please include:
- A description of the issue
- The affected Canon product or endpoint
- Reproduction steps
- Potential impact
- Relevant screenshots or request identifiers
Next step
Review the permissions above, then install Verify for a selected repository. The Canon GitHub App is a separate installation when you’re ready to govern that repository.