superagent_

// your software

Repositories

[ view markdown ]

Repositories are part of your software. They contain source code, dependency declarations, build and release workflows, and security configuration.

Available products

Product What it does for repositories
PR Scanning Reviews code, workflows, dependencies, contributor risk, and agreement coverage before merge
Dependency Validation Tests dependency vulnerabilities and verifies proposed fixes
Red Teaming Finds and verifies attack paths through source code and repository configuration

Repository settings

Repository lists every GitHub repository Superagent can access through your installed GitHub Apps. It is the hub for per-repo configuration: most product behavior is tuned here, not globally.

The repository list

Each row shows the repository name, its visibility (public or private), and a capability badge for each installed app: Security, CLA, or both.

If the list is empty, install a GitHub App from Integrations and select repositories in GitHub. Repos appear only after an app can access them.

The repository detail page

Open a repository at /app/repository/[repositoryId] to manage settings that apply only to that repo.

Security settings

With the Superagent Security app installed, you can:

  • Turn Security scan, Supply Chain Scan, Contributor trust, and Triage Advisories on or off
  • Under Dependency scans, enable Verify vulnerable dependency updates for Dependabot and Renovate security PRs
  • Enable Red teaming, choose release or calendar triggers, and start a manual run
  • See recent pull request checks

Supply chain scanning and security scanning are enabled by default. Contributor trust and advisory triage are enabled by default on public repositories and off by default on private repositories. Dependency Validation is off by default and must be enabled by an organization owner per repository. See Security scanning, Supply chain scanning, Contributor Trust, and Dependency Validation.

For repository Red Teaming setup and results, see Repositories.

CLA settings

With the Open CLA app installed, you can:

  • Assign an Agreement template version
  • Choose the signing mode: in-app Markdown or Dropbox Sign
  • Review CLA check status and linked documents

The GitHub check name is Contributor License Agreement. See Contributor Agreements.

Contributors on this repo

The detail page lists contributors with activity on this repository, with CLA and trust columns when the corresponding apps are installed, and links to their org-wide Contributor Trust profiles.

Human control

GitHub checks, branch protection, CI, code review, and merge approval remain the control boundary for repository changes.

Next steps