Skip to main content
The Trident GitHub integration closes the gap between a security finding and an engineering fix. When Trident identifies a remediable issue — an over-permissive IAM policy, a Kubernetes RBAC misconfiguration, a Terraform drift, or a code-level agent vulnerability — it opens a draft pull request in the repository you designate, complete with a description of the finding, the proposed change, and a direct link back to the finding in the Trident dashboard. Your team reviews and merges on their own schedule; Trident never touches your main branch.

​
Install the Trident GitHub App

1

Open the GitHub integration settings

In the Trident dashboard, navigate to Settings → Integrations → GitHub and click Install App.
2

Authorize the Trident GitHub App

GitHub will redirect you to the App authorization screen. Select whether to grant access to your entire organization or to specific repositories, then click Install & Authorize.
3

Select target repositories

Back in the Trident dashboard, choose which repositories Trident is allowed to open PRs in. You can select one repository per project or multiple repositories for a monorepo setup.
4

Save and confirm

Click Save. A green status indicator on the integration card confirms the connection is active. Trident will now open draft PRs in the selected repositories when remediable findings are detected.

​
What Trident creates PRs for

Once the GitHub App is installed, Trident automatically opens draft pull requests for the following finding types:
Finding typeExample change
IAM policy fixesRemove wildcard * actions from an over-permissive AWS policy
Terraform changesAdd encryption or restrict public access on an S3 bucket resource
Kubernetes RBAC patchesScope a ClusterRole to namespace-level permissions
Agent code fixesApply a system-prompt hardening patch suggested by Sentinel’s Fix Agent

​
Pull request format

Every PR Trident opens follows the same structure:
  • Draft status — PRs always open as drafts so they do not trigger auto-merge rules or required-review workflows until your team is ready.
  • Finding summary — The PR description includes the finding name, severity, affected resource, and the reasoning behind the proposed change.
  • Proposed diff — The change is scoped to the minimum edit needed to resolve the finding.
  • Dashboard link — A direct link back to the finding in Trident so reviewers have full context before merging.

​
Required permissions

The Trident GitHub App requests the following permissions:
PermissionLevelReason
pull_requestsWriteCreate and update draft PRs
contentsReadRead repository files to generate accurate diffs
Trident does not request push access to your default branch. It cannot force-push, merge pull requests, or modify branch protection rules.
PRs opened by Trident are always drafts. Trident never force-pushes to any branch, merges a pull request, or bypasses branch protection rules. A human must review and merge every change.