> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/github/gh_app_access.md).

# GH\_APP\_ACCESS

## Summary

|                              |                                           |
| ---------------------------- | ----------------------------------------- |
| **Forestall ACL Alias**      | GH\_APP\_ACCESS                           |
| **Edge Type**                | Relationship                              |
| **Affected Object Types**    | GitHub Repositories                       |
| **Exploitation Certainty**   | N/A (structural)                          |
| **GitHub Role / Permission** | GitHub App installation repository access |

## Description

`GH_APP_ACCESS` is a **structural relationship** recording that a GitHub App installation has access to a repository:

```
(GHAppInstallation)-[GH_APP_ACCESS]->(GHRepository)
```

It is created for installations with `repository_selection = "selected"`, linking the app to each specific repository it was granted. (Installations with `repository_selection = "all"` implicitly reach every org repository; that breadth is captured at the organization level rather than as one edge per repo.)

This edge is the app equivalent of `GH_COLLABORATOR` (user → repo) and `GH_HAS_ACCESS` (team → repo): it shows which repositories an app can touch. It is part of the **attack surface** — compromising the app (its private key or an installation token) yields access to these repositories — but it is structural; the dangerous, admin-level reach is modelled by `GH_ADMIN` (app → org).

## Identification

### GitHub Web Interface

Open the organization → **Settings → GitHub Apps** → an installation → **Repository access** shows the selected repositories.

### GitHub CLI

```bash
# repositories accessible to an installation (requires the app's installation token)
gh api "/installation/repositories" --jq '.repositories[].full_name'
```

## Exploitation

Not applicable on its own — `GH_APP_ACCESS` is structural. The repositories reachable through it become exploitable if the app's credentials are compromised; the impact depends on the app's permission set (read vs write vs admin — see `GH_ADMIN`).

## Mitigation

1. **Scope app repository access narrowly** — prefer "only select repositories" over "all repositories".
2. **Grant least permission** to the app, so even reachable repos expose minimal capability.
3. **Protect app credentials** (private key, installation tokens) and review installations regularly.

## Detection

| Event                                           | Description                                    |
| ----------------------------------------------- | ---------------------------------------------- |
| `integration_installation.repositories_added`   | An installation gained access to repositories  |
| `integration_installation.repositories_removed` | Repositories were removed from an installation |

Alert on installations gaining access to sensitive repositories.

## References

* <https://docs.github.com/en/rest/apps/installations#list-repositories-accessible-to-the-app-installation>