For a scanner pilot, grant read only access to a short list of named repositories, use an app or token you can revoke on the last day, and keep write permissions off until you have tested automated changes on a throwaway repo. Check what scopes the vendor really asks for against what the feature needs.
Start from what the tool needs to do
A software composition scanner reads manifests and lockfiles. A code scanner reads source. Neither needs permission to push. Ask the vendor to list each permission it requests and the feature that depends on it, then refuse any scope that does not map to something you are testing.
A sensible starting set
- Read access to selected repositories only, not every repository in the organisation.
- Read access to pull request metadata if you want pull request comments.
- Status or check write access only if you want a gate on pull requests.
- No write to repository contents in the first phase.
- No organisation admin or secret read scopes.
Many source control platforms let you install an app on selected repositories, which is easier to audit and revoke than a personal token.
Test write access separately
Automated fix pull requests need permission to create branches and pull requests. Test that on a repository with no production role, with branch protection and required review in place so a bot cannot merge its own change. See piloting automated fixes on one repo first. Whatever tool you choose, keep any automated remediation off by default until a human has reviewed what it produces.
Service accounts and tokens
- Create a dedicated service account for the pilot, not a developer's personal account.
- Use the shortest expiry the platform allows.
- Store the token in your secrets manager, not in a chat message.
- Record the name, scopes, owner and expiry in your pilot document.
Revocation plan
On the last day:
- Uninstall the app or revoke the token.
- Confirm in the source control audit log that access stopped.
- Remove webhooks.
- Remove the vendor from SSO and deactivate users.
- Ask the vendor to delete pilot data and confirm in writing.
Check, then trust
After installing, look at the audit log of the repositories. Does the tool read only what you expected? If you see activity on repositories you did not select, stop and ask.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can a scanner pilot run with no write access at all?
Yes. Scanning, reporting and pull request comments do not require repository write access. Only automated fixes do.
Is a personal token acceptable for a short pilot?
It is a poor choice. When that person leaves or the token leaks, the exposure is wider than one tool. Use an app or service account.
Last reviewed: 19 October 2026.
