Setup

Scan GitHub organizations behind single sign on

A personal access token used against an organization with SAML single sign on has to be authorized for that organization specifically. The failure mode when it is not is the dangerous part: it does not fail.

What to do

Create a classic personal access token with repo and read:org. Add security_events if you want the host's own alerts folded in.
On the token page, press Configure SSO and authorize it for every organization you want scanned. That step sends you through the identity provider once, in a browser.
Check what the token can actually see before scanning with it.
```
ghscan check
```
Add the connection in the product and scan one organization first.
Read the scan warnings. If a token is authorized for some organizations and not others, GitHub returns a success with the missing ones quietly absent, and marks the response with a header. The scanner watches for that header, warns, and records it in the report.

Worth knowing

A truncated scan looks exactly like a clean one unless something is watching for it. If the report says the results were truncated, the report is incomplete and the counts in it mean nothing.