Chainloop is a supply-chain security and governance platform. This GitHub App connects your repositories to Chainloop to correlate AI coding sessions and pull requests, run security and SCM configuration checks, publish policy evaluation results as commit checks, and open auto-remediation PRs for discovered vulnerabilities. Write access is used only to post Chainloop's own PR comments, check runs, and remediation branches — sensitive operations use short-lived, repository-scoped tokens.

For more information about how Chainloop interacts with your GitHub repositories and a breakdown of required permissions, refer to this guide