Why Does CursorGuard Need Access to My GitHub?

If you’re new to using security tools, you might be wondering: “Why do I need to give CursorGuard access to my GitHub repos?”

This is a great question, and we completely understand the hesitation. You’re trusting us with your code, and that’s not something we take lightly.

Here’s the Simple Answer

We need to read your code to find security problems.

Think of it like this: If you hired a home security inspector, they’d need to walk through your house to find vulnerabilities. We’re doing the same thing, but for your code.

This Is Industry Standard

Here’s the thing that might surprise you: Every major security and code quality tool works exactly the same way.

You’re not doing anything unusual by giving us access. In fact, if you’re serious about code security, this is how it’s done.

Who Else Does This?

Every single one of these tools requires GitHub access:

• GitHub Advanced Security - Built by GitHub themselves
• SonarQube / SonarCloud - Used by millions of developers worldwide
• Snyk - Major security platform trusted by Fortune 500 companies
• Checkmarx - Enterprise security scanning
• Veracode - Application security testing
• GitGuardian - Secret detection and monitoring
• CodeClimate - Code quality and security analysis
• Codacy - Automated code reviews
• DeepSource - Static code analysis
• Renovate / Dependabot - Dependency update tools

They all need access to your repos. Why? Because they can’t scan what they can’t see.

What We Actually See

When you connect CursorGuard to your GitHub account, here’s what happens:

1. You install our GitHub App - This is GitHub’s official, secure way for tools to connect
2. You choose which repos to scan - You’re in control of what we see
3. We temporarily download your code - Just long enough to run security scans
4. We delete it when we’re done - We don’t keep copies of your code sitting around

We can only see what you explicitly give us access to. We can’t see your entire GitHub account or repos you didn’t select.

Why We Use GitHub’s Official App System

GitHub created the GitHub App system specifically for tools like ours. It’s designed to be:

• Secure - Built with security best practices
• Transparent - You can see exactly what permissions we’re asking for
• Revocable - You can remove our access anytime with one click
• Limited - We only get the specific permissions we need, nothing more

What If You Don’t Trust Any Tool?

That’s your call, and that’s totally fine. But here’s the reality:

You can’t scan code without reading it.

If you want automated security scanning (which, trust us, you do), you have to let the tool see your code. There’s no way around it.

The alternative? Manual security reviews, which are:

• Expensive (hundreds to thousands of dollars per review)
• Slow (weeks or months turnaround)
• Less thorough (humans miss things)
• Not scalable (can’t review every single commit)

Our Commitment to You

Here’s what we promise:

✅ We only read your code to perform scans
✅ We don’t sell or share your code
✅ We delete temporary copies immediately after scanning
✅ We use industry-standard security practices
✅ You can revoke access anytime

Still Have Concerns?

We get it. Security is important, and you should be cautious about who you trust.

If you’re still uncomfortable, here’s what you can do:

1. Start with a test repo - Create a small, non-sensitive project and scan that first
2. Check our GitHub App permissions - See exactly what we’re asking for
3. Read reviews from other users - See what the community says about us
4. Ask us questions - We’re here to help and happy to explain anything

The Bottom Line

Giving security tools access to your GitHub repos is completely normal and expected.

Every serious developer using modern security tools does this. It’s not risky—it’s responsible.

If someone tells you “never give any tool access to your repos,” they’re either being overly paranoid or don’t understand how the industry works.

Your code is safer with automated security scanning than without it.

---

Ready to secure your code? Get started with CursorGuard and run your first scan today.