Skip to main content

​
Overview

The GitHub integration makes Pwnbook a first-class PR review environment. Once connected, GitHub appears as an external source in your sidebar, giving you access to:
  • Pull request list across all connected repositories
  • Full PR detail: commits, file diffs with syntax highlighting, reviews, inline code comments
  • Post issue comments and submit reviews (Approve, Request Changes, Comment) directly from Pwnbook
  • Expandable diff context on inline review comments

​
PAT requirements

GitHub access uses a Personal Access Token (PAT). You configure your own PAT in Profile → Connections tab. Create a fine-grained PAT at GitHub → Settings → Developer Settings → Personal Access Tokens → Fine-grained tokens. Important: If you’re accessing repositories in a GitHub organization, the PAT’s resource owner must be set to that organization — not your personal account. GitHub fine-grained PATs scoped to “all repositories owned by you” only cover your personal repos. To create an org-scoped PAT, go to:

​
Alternative: classic PAT

A classic PAT with the repo scope works for both personal and organization repositories without the resource owner restriction.

​
Multi-PAT support

If you work across multiple GitHub organizations with different access scopes, you can add multiple PATs in Profile → Connections. Each PAT can be scoped to a specific organization (by org name) or set as a catch-all. When Pwnbook fetches data for a PR:
  1. It looks for a PAT matching the PR’s repository owner.
  2. If no match, it falls back to your catch-all PAT.
  3. If no multi-PAT is configured, it falls back to your legacy Code Hosting Connection PAT.

​
Setting up the GitHub App

For organization-wide sync of pull requests, repositories, and webhook events, connect a GitHub App:
1

Install the GitHub App

  1. Go to Organization Settings → Marketplace → GitHub.
  2. Click Install GitHub App.
  3. You’ll be redirected to GitHub to install the Pwnbook GitHub App.
  4. Select the GitHub organization or personal account.
  5. Choose which repositories to grant access to.
  6. Click Install.
You’ll be redirected back to Pwnbook once installation is complete.
2

Sync repositories

After installing, click Sync Repositories to pull the list of repositories the app has access to. This populates the repository list in the GitHub external source.
3

Sync pull requests

Click Sync Pull Requests to import open PRs from connected repositories into Pwnbook. Pull requests are then available for review in the GitHub external source.

​
Reviewing pull requests

Navigate to Sources → GitHub in the sidebar to access the PR list.

​
PR detail view

Click any pull request to open the detail view. The tabs show: All comment and review bodies render full markdown.

​
Submitting a review

From the Reviews tab, the review panel is at the top:
  1. Optionally type a review comment.
  2. Click Approve, Request changes, or Comment only.
The review is submitted to GitHub immediately.

​
Posting a comment

From the Comments tab:
  1. Type your comment in the input at the bottom.
  2. Click Post comment.
The comment appears on the GitHub pull request.

​
Webhook events

When the GitHub App is installed, Pwnbook responds to the following webhook events:

​
Uninstalling the GitHub App

To completely remove the GitHub App from your GitHub account or organization:
  1. Go to GitHub → Settings → Applications → Installed GitHub Apps.
  2. Find the Pwnbook app and click Configure.
  3. Click Uninstall.
Uninstalling the GitHub App immediately stops all webhook delivery and PR sync. Reconnecting requires reinstalling the app from the Pwnbook marketplace.