GitHub App permissions
What the heyGRC GitHub App can read and write, and what it never does to your source.
Install path: github.com/apps/heygrc/installations/new.
Permissions heyGRC asks for
heyGRC requests the minimum needed to review pull requests and post results:
| GitHub permission | Level | Purpose |
|---|---|---|
| Contents | Read-only | See file context beyond the diff and read the optional .heygrc.md repo config |
| Metadata | Read-only (mandatory) | Repository and installation metadata |
| Checks | Read and write | Post the heyGRC check run status |
| Pull requests | Read and write | Read the PR and changed files; post the review, inline comments, and the sticky summary |
No Issues permission and no organization permissions are requested. PR conversation comments go through GitHub's pull request surface, which the Pull requests permission covers. The table should match the GitHub consent screen line for line; if it ever does not, trust the consent screen and tell us.
What heyGRC does not need
- Write access to your code (it does not push commits or edit files)
- Admin access beyond what you grant at install (you choose all repos or a subset)
Prefer Only select repositories if you want a tight footprint.
What heyGRC posts back
- Check runs (neutral/success by default)
- Review comments (inline findings)
- One sticky summary per PR (updated in place)
It does not merge PRs and does not submit "Request changes" as a hard block. See Does heyGRC block merges?.