What Norma can do — and cannot do #

When you authorise Norma on GitHub, we request read-only access to your code. Specifically, Norma can:

• Read source files in the repositories you grant access to.
• List your repositories and branches (to populate the picker when you add a new repo).
• Post and remove Norma’s own results comment on your pull requests, if you installed the Norma GitHub App. That comment is the only thing Norma ever writes to GitHub — see Pull request checks. Pull request checks are available on every tier, including Free, and consume no scan quota.

Norma cannot:

• Push commits, open pull requests, or write to your code in any way.
• Read repositories you didn’t explicitly grant access to.
• Read your private profile, billing, or organisation membership beyond what’s needed to display a name.
• Persist your code beyond the duration of a scan — clones are deleted as soon as the scan finishes.

Connecting for the first time #

1. From the Repositories page, click + Add Repository in the top right.
2. Click Connect GitHub. You’re redirected to github.com to authorise the Norma GitHub App.
3. On the GitHub authorisation screen, choose which repositories Norma can read. You have two options:
   • All repositories — grants access to every repo on your account, now and in the future. Easiest, but broadest.
   • Only select repositories — pick specific repos. We recommend this for tighter control.
4. Click Install & Authorise.
5. You’re back in Norma on the Select repository screen, which lists every repository you just authorised. Pick the one to scan first.

Once authorised, the GitHub connection is saved at the workspace level, so you don’t have to repeat this for every repository you add later — the picker just shows all the repos you’ve authorised.

Adding more repositories later #

If Norma already has a GitHub connection in this workspace, the + Add Repository flow skips straight to the Select repository screen. You’ll see every repository Norma has access to.

If the repository you want isn’t in the list, you need to expand Norma’s access on GitHub’s side — see “Changing which repositories Norma can see” below.

Changing which repositories Norma can see #

1. Go to github.com → Your profile → Settings → Applications → Installed GitHub Apps.
2. Click Configure next to the Norma app.
3. Under Repository access, add or remove repositories.
4. Click Save.

The next time you open + Add Repository → Select repository in Norma, the updated list appears.

If you remove a repository that Norma had already imported, the repository stays in Norma but future scans will fail. You can either re-grant access or remove the repository from the workspace.

Connecting from a GitHub organisation #

If you want to scan repositories owned by a GitHub organisation (rather than your personal account), an organisation owner has to authorise Norma. On the GitHub authorisation screen, choose the organisation from the account picker at the top. If you’re not an owner, GitHub will let you request approval — the org admin gets a notification.

Revoking Norma’s access #

You can remove Norma’s access entirely at any time:

1. github.com → Settings → Applications → Installed GitHub Apps.
2. Click Configure next to Norma.
3. Scroll to the bottom and click Uninstall.

Norma stops being able to read any code. Existing scan history in Norma is preserved, but no future scans will run. If you reconnect later, you’ll start fresh.

Troubleshooting #

The repository I want is not in the picker. #

Norma doesn’t have access to it. Either re-run the connection flow and choose All repositories, or expand access on GitHub’s side as described above.

OAuth fails with “Could not connect to GitHub”. #

Most often this means cookies are blocked or you have multiple GitHub accounts logged in. Try in an incognito window. If it still fails, check that Norma isn’t blocked at the organisation level (some GitHub orgs restrict third-party apps).

A scan fails with a permissions error. #

You’ve revoked or restricted Norma’s access since the repository was imported. Re-authorise on GitHub.

My organisation requires SSO and the app installation is blocked. #

Your org admin has to add Norma to the allow-list. Send them a link to the Norma GitHub App page — they can approve it from there.

Related #

• Connect Bitbucket — the parallel walkthrough for Bitbucket.
• Repositories overview — what to do once you’ve connected your first repo.
• Repository providers — the high-level reference covering all providers.
• The Norma GitHub App — installing from GitHub instead, which also creates your account.
• Pull request checks — the automatic check Norma runs on every pull request.