What to Connect and Why
Neo uses these connections to build a complete picture of your attack surface and test it the way a real attacker would, with access to both your code and your running applications.| Connection | What Neo Uses It For |
|---|---|
| Source code (GitHub) | Reading code changes in PRs, tracing data flows, understanding application architecture, correlating code-level patterns with runtime behavior |
| Application environments | Testing running applications, validating exploitability against real services, browser-based testing, API interaction |
| Environment variables | Authenticating to your services, accessing protected endpoints, connecting to databases and third-party APIs during assessments |
| Issue tracking (Linear, Jira) | Creating findings as trackable issues, syncing status, triggering retests when fixes ship |
| Communication (Slack) | Notifying your team of completed assessments, critical findings, and retest results |
Connecting GitHub
GitHub is the primary way Neo accesses your source code and integrates into your development workflow.Install the GitHub App
Install the Neo GitHub App
Click Connect GitHub and follow the OAuth flow to install the Neo GitHub App on your organization. You can grant access to all repositories or select specific ones.
What GitHub Access Enables
Once connected, Neo can:- Review PRs automatically. When a developer opens a pull request, Neo analyzes the code changes for security implications, tests exploitability against your running environment, and posts findings directly on the PR.
- Read source code for deeper analysis. During any assessment, Neo can reference your codebase to trace data flows, understand business logic, and correlate code patterns with runtime vulnerabilities.
- Track changes over time. Neo monitors merged PRs to update its understanding of your attack surface, identifying areas where new risk may have been introduced.
Neo requires read-only access to repository contents and pull requests. It does not need write access to your codebase.
Environment Best Practices
Use staging or dedicated testing environments. Neo runs all exploit attempts inside isolated sandboxes, but pointing it at a staging environment ensures your production data and users are never involved. A staging environment that mirrors production gives Neo the most realistic attack surface to test against. One environment per service. If your stack includes multiple services (e.g., a frontend, an API, and a background worker), add each as a separate environment. This gives Neo a clear map of your architecture and allows it to test cross-service interactions. Keep environments up to date. Neo’s assessments are only as accurate as the environment it’s testing against. If your staging environment drifts significantly from production, findings may not reflect real-world risk. Environments that stay in sync with your deployment pipeline give Neo the best signal.Configuring Environment Variables
Some of your services require authentication or specific credentials to access. Environment variables let you securely provide Neo with the secrets it needs to test authenticated flows and protected endpoints.Add variables
Define key-value pairs for credentials, API keys, tokens, or any secrets Neo needs during assessments. Common examples include:
API_KEY— API keys for your servicesAUTH_TOKEN— Authentication tokens for accessing protected endpointsDATABASE_URL— Connection strings for database access during testingSESSION_COOKIE— Pre-authenticated session cookies for bypassing login flows
Connecting Issue Tracking
Connecting your issue tracker lets Neo create findings as real, trackable issues in the tools your team already uses. When a fix ships, Neo can automatically detect the change and retest to confirm the vulnerability is resolved.Linear
Jira
Once connected, every validated finding Neo reports becomes a trackable issue with full evidence, reproduction steps, and remediation guidance attached. When the linked PR or fix deploys, Neo retests automatically and updates the issue status.
Connecting Slack
Slack integration keeps your team informed as assessments run and findings come in.Configure notification channels
Choose which Slack channels receive notifications. You can route by event type:
- Assessment completed — summary of findings when a scan finishes
- Critical finding — immediate alert when a high-severity vulnerability is validated
- Retest passed — confirmation that a fix resolved the vulnerability
- Regression detected — alert when a previously fixed vulnerability reappears
Verifying Your Setup
Once you’ve connected your stack, verify everything is working:Check the Integrations dashboard
Go to Settings → Integrations and confirm all connections show a healthy status.
Run a quick assessment
Ask Neo to run a lightweight scan against one of your connected environments. A simple instruction like “Run a security review of [your staging URL]” is enough to confirm Neo can reach your environment, authenticate, and report findings.
Confirm issue tracking
If you’ve connected Linear or Jira, verify that findings from the test assessment appear as issues in the correct project.
Next: Your First Scan
Now that your stack is connected, run your first real security assessment with Neo.