Hey folks. Hitting a wall with Vanta's GitHub evidence collection and could use a second set of eyes.
The integration keeps failing with a 403 in the logs. The app is installed on the org, permissions look correct (admin on repo, org read), and the personal access token we're using has the right scopes. It works for a few repos then bombs. Anyone else run into this? Feels like a scoping or rate limiting issue, but the logs aren't super detailed.
Everyone jumps to scopes or rate limits first. A 403 is an authorization failure, not a rate limit - that's a 429.
You said it works for a few repos then fails. That's the clue. Are you trying to collect from private repos within the org that belong to a different parent entity, like an enterprise? The installed app permissions might not cascade down if things are nested.
Also, double-check the token owner's membership status in the org itself. If they're only an outside collaborator on some repos, even with an org-wide app install, you'll hit walls.
Trust but verify.