Hey everyone, I've been tasked with setting up Vanta for our startup's security compliance, and the first big hurdle is getting it connected to our on-prem GitHub Enterprise Server. The docs are okay, but I'm hitting some snags that I think are specific to private instances.
I'm trying to follow Vanta's "GitHub App" installation method. Has anyone gone through this with a private GHE instance? The main issue I'm running into is with the callback URL during the app registration on our GitHub side. Vanta's instructions provide a generic ` https://app.vanta.com` callback, but our internal GitHub can't reach that externally. Do we need to open a specific egress firewall rule from our GitHub server to Vanta's IPs? Or is there a proxy setup involved?
Also, the permissions scopes for the GitHub App are pretty broad. We're starting with a test repo, but I'm curious about the `metadata` and `contents` read permissions across all our private repos. Is that standard? Here's the manifest we're about to approve, which feels like a big access grant:
```json
{
"name": "Vanta",
"url": "https://www.vanta.com",
"hook_attributes": {
"url": "https://app.vanta.com/github/some-unique-path"
},
"request_oauth_on_install": true,
"callback_urls": ["https://app.vanta.com/github/oauth/callback"],
"public": false,
"default_permissions": {
"metadata": "read",
"contents": "read"
},
"default_events": [
"push",
"pull_request"
]
}
```
Any gotchas during the actual OAuth flow? Our GHE version is 3.8, so not the latest. Also, once connected, does Vanta pull the entire commit history immediately, or just incremental changes? Worried about that initial data load.
Would love to hear from anyone who's done this integration before. Practical tips and common pitfalls would be a huge help!
Learning by breaking
We had the same callback issue. The generic URL won't work from your private network. You need to open egress for your GHE instance to Vanta's API endpoints. Get their IP ranges from support - it's not documented publicly. Once you allow that, the app registration callback will succeed.
On permissions, yes, that's standard for full repo scanning. They need read on metadata and contents to inventory your assets and check configs. If you're worried, start with a test org-wide app install limited to a single test repo, but for full compliance you'll have to grant org-wide access eventually.
Benchmarks don't lie.
That's a solid workaround for the callback, but the firewall rule has compliance implications that aren't always considered upfront. Opening egress to a vendor's IP range creates a dependency that should be tracked in your change log and security baseline.
You're right that support provides the ranges, but they can change. I'd recommend adding a monitoring alert for failed connections from your GHE instance to Vanta's endpoints. This way, if Vanta rotates IPs and your rule becomes stale, you'll get notified by the drift, not by a failed compliance scan.
Starting with a test repo is good, but remember that an org-wide install with limited repository access still grants the app read permissions on organization *metadata*. For some compliance frameworks, that broader access needs explicit approval in your documentation.