Connect your repositories
Get every repository into Socket with no change developers can see, so you have a baseline before you test anything.
Socket SCA reads your manifests and lockfiles, resolves the full dependency tree, and scores every package. Your source code is not uploaded. On GitHub, the least-work way in is the Socket GitHub App: install it on every repository with silent mode on, and developers see nothing until you decide they should.
Not on GitHub, or want to gate from a pipeline instead? Use Scan from CI/CD.
Before you start:
- A Socket organization. Its slug is in the dashboard URL:
https://socket.dev/dashboard/org/your-org. - Owner rights on the GitHub organization, to install an app.
- Node.js on your workstation, for the Socket CLI.
- A Socket API token for the POC (Settings → API Tokens). One token with the scopes below covers every page in this guide.
| Scope | Used for | Page |
|---|---|---|
full-scans:create | Creating scans (socket scan github, socket scan create, socket fix) | This page, CI/CD, Full application reachability, Fix |
repo:list | Finding your repositories (socket scan github --all) | This page |
fixes:list, packages:list | Computing fixes (socket fix) | Fix what matters |
full-scans:list | Reading scan results through the API | Cut CVE noise with reachability |
historical:alerts-list | Finding CVEs that have a patch | Patch what you can't upgrade |
report:read | Exporting SBOM and VEX | Export SBOM and VEX |
1. Install the app on one sandbox repository
Installing the app starts scanning open pull requests straight away. Install it on a single new repository first, so you can switch on silent mode before it sees anything else.
- In GitHub, create an empty repository named
socket-poc-sandboxwith a README, so it has amainbranch. You'll use it again for the pull request test. - Go to github.com/apps/socket-security and install the app on your organization.
- Under Repository access, choose Only select repositories and pick
socket-poc-sandbox.
2. Turn on silent mode
In the Socket dashboard, open Settings → GitHub and turn on Silent Mode.
Socket still scans every commit and pull request and shows the results in the dashboard. It posts no comments and no check runs on GitHub.
Silent mode is organization-wideIt covers every repository the app can see. You turn it off once, when you're ready, in Tune policy and enforce.
3. Give the app every repository
In GitHub, open Settings → GitHub Apps → Socket Security → Configure. Change Repository access to All repositories. Repositories you create later are included automatically.
4. Create the baseline
Socket scans a repository on its next commit or pull request that touches a manifest. To get a baseline for every repository now instead of waiting, scan each default branch from your workstation. This reads manifests through the GitHub API, so nothing is cloned.
First check Repositories in the dashboard. --all scans the repositories Socket already knows about, not every repository on GitHub. If some are missing, name them instead with --repos repo1,repo2.
npm install -g socket
socket login # paste your API token from Settings → API Tokens; sets your default org
# Fine-grained GitHub token with Contents: read-only on all repositories.
# Required even with the app installed.
export GITHUB_TOKEN=github_pat_...
socket scan github --all --org-github your-github-org --no-interactiveEach scan is marked as the repository's default-branch scan, which is what the Alerts page shows. The command doesn't wait for results.
Verify
- Repositories in the dashboard lists your repositories
- Alerts shows findings across repositories (allow 15 minutes to an hour after the baseline)
- No Socket comments or checks appear on GitHub pull requests
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| A repository shows very few dependencies | No lockfile, so only declared packages resolve | Commit the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, uv.lock, poetry.lock) |
| Python repository has packages but no dependency tree | Scanned from requirements.txt | Use a lock file (uv.lock or poetry.lock). A top-level-only requirements.txt also misses packages |
| Gradle or sbt repository shows no dependencies | Build files need to be resolved by the build tool first | Scan it from CI, following the Gradle note in Scan from CI/CD |
| A repository is missing from Alerts | Alerts shows default branches only, and there's no default-branch scan yet | Rerun step 4, or merge any manifest change |
| Internal packages show no findings | Socket doesn't analyze private packages, and their own dependencies don't appear in the graph | Expected. Ask your Socket team about scanning the internal package's own repository |
socket scan github asks which org | No default org set | Run socket login again, or add --org your-org |
What the POC proves next
| Goal | Page |
|---|---|
| Scan repositories that aren't on GitHub, or gate a pipeline | Scan from CI/CD |
| Show a risky dependency is caught in a pull request | Catch risky dependencies in pull requests |
| Decide what fails a pull request, and where | Tune policy and enforce |
| Flag or block by license | License policy |
| Measure how much CVE noise goes away | Cut CVE noise with reachability |
| Turn findings into upgrade pull requests | Fix what matters |
| Remove CVEs that have no upgrade | Patch what you can't upgrade |
| Hand results to other tools | Export SBOM and VEX |
Reference
Updated 8 days ago