Skip to main content
Applies to BloodHound Enterprise and CE The OpenHound GitHub collector is the SpecterOps-supported tool for retrieving GitHub organization data for BloodHound. If you are evaluating collector options for the GitHub extension, this is the recommended path. An alternative collector, GitHound, also exists, but this documentation section focuses specifically on the OpenHound-based collector.

​
Data Collection & Privacy

The GitHub collector is an open-source, read-only data collector. It requests only read-only permissions and never modifies your GitHub organization, repositories, or settings. The one exception is the optional manage_runners:enterprise PAT scope used for enterprise self-hosted runner collection: GitHub does not offer a read-only equivalent, and the scope permits runner-management operations even though OpenHound only uses it to read runner data.

​
What the GitHub collector collects

  • Organization metadata and custom roles
  • User accounts, team memberships, SAML/SSO identities, and SCIM-provisioned identities
  • Repository details, branch protection rules, and repository roles
  • GitHub Actions workflow YAML files (for trigger and permission analysis)
  • Deployment environments, branch policies, reviewer gates, and deployment activity
  • Organization and repository-level secrets and variables metadata
  • Secret scanning alerts
  • GitHub App installations and personal access token (PAT) grants

​
What the GitHub collector does not collect

  • Source code content (except GitHub Actions workflow YAML files)
  • Secret values or credentials

​
Data storage

All collected data is stored locally on the machine running the GitHub collector, in JSON files written to the working directory. The GitHub collector communicates solely with the GitHub API using the credentials you provide — no data is sent to any other external service. Authentication credentials are held in memory only during collection and are never written to disk. Output files persist on your local filesystem until you delete them.

​
Authentication Options

The OpenHound GitHub collector supports the following authentication setup options:
  • Enterprise GitHub App installation: Use this option when you need enterprise-scoped collection (recommended). To collect enterprise SSO and SCIM data, add a classic PAT from an Enterprise Owner with the read:enterprise scope. To also collect enterprise self-hosted runner data, add the manage_runners:enterprise scope.
  • Organization GitHub App installation: Recommended for larger GitHub organizations because it offers higher rate limits.
  • Fine-grained Personal Access Token: Simpler to set up for smaller environments and testing.
The GitHub App installation and Fine-grained PAT options require only read-only permissions. The optional classic PAT scopes for enterprise SSO, SCIM, and self-hosted runner data are read-only for read:enterprise, but manage_runners:enterprise permits runner-management operations and is not read-only. See Configure the Collector for the required permission set and runtime configuration.

​
Next Steps