1. Getting Started
Complete 6-step walkthrough for onboarding an authorized private repository.
Step 1: Install the GitHub App
Install the official PHANTOM GitHub App into your personal account or organization. The App requests minimum necessary read permissions: Repository Contents (Read) and Repository Metadata (Read). No personal access tokens or OAuth write scopes are accepted.
Step 2: Connect Repository
In the workspace, select the authorized private repository from the dropdown. The control plane verifies organization membership and installation ID before recording repository metadata.
Step 3: Select Branch / Commit SHA
Pick the target branch or tag. The UI queries GitHub's Git Data API to resolve the exact 40-character commit SHA, ensuring analysis is pinned immutably to a reproducible codebase state.
Step 4: Launch Idempotent Scan
Initiate scan admission. An Idempotency-Key header binds the target, ref, and commit SHA, preventing duplicate task enqueuing or redundant compute consumption.
Step 5: Follow Live Stream & Inspect Findings
Follow live execution via SSE stream. Review discovered findings, source code line numbers, observed behavior, and synthesized remediation diffs.
Step 6: Push Remediation & Rescan for Delta
Apply fixes, commit to your branch, and click 'Rescan latest commit'. PHANTOM automatically computes finding lineages into Resolved, Persistent, and New categories.