Preparing GitHub for Burp Suite DAST - Port Swigger
Summary: PortSwigger's setup guide for Burp Suite DAST says the tool connects to GitHub through a fine-grained personal access token and raises every GitHub issue and comment as the account that owns that token. It requires Issues read and write plus Metadata read permissions, and Projects read and write only when an action adds issues to a GitHub project.
What you should know: If the token's account lacks the Write role on a repository, GitHub still creates the issue but silently drops the labels, assignee and milestone, with no error reported. The token check Burp runs on connection only reads the owning account and does not test repository access, so a token that can reach no repository can still pass.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026