Vrymdor™Protect your GitHub repositories
Vrymdor watches the GitHub changes that matter for security: who pushed, who rewrote history, who changed who has access, and who weakened branch protection. No server or connector is needed.
What Vrymdor tracks
| GitHub event | What you see | Severity |
|---|---|---|
| Pushes | Who pushed how many commits to which branch | Info |
| Force pushes | History rewritten on a branch | High on the default branch, medium elsewhere |
| Pull requests | Opened, closed, merged | Info or low |
| Collaborators (member) | Someone added or removed | Medium |
| Branch protection rules and rulesets | Created, edited, deleted | High when deleted, medium otherwise |
| Repository | Made public, deleted, transferred | High |
| Deploy keys | Created or deleted | Medium |
| Secret scanning alerts | GitHub found an exposed secret | High |
Vrymdor keeps the repository name, the GitHub user, the event and a one-line summary. It does not keep code, commit contents or diffs.
Set it up (organization webhook, recommended)
An organization webhook covers every repository, including new ones.
- In GitHub, open your organization, then Settings, then Webhooks, then Add webhook.
- Payload URL: the GitHub webhook URL from your approval email. It looks like
https://api.vrymdor.com/v1/ingest/github?tenant=<your workspace id>. - Content type:
application/json. - Secret: your AWARENESS_TOKEN (the same token as in your install command). GitHub uses it to sign every delivery and never sends it.
- Which events: choose "Let me select individual events" and tick Pushes, Pull requests, Collaborator add, remove, or changed, Branch protection rules, Repository rulesets, Repositories, Deploy keys, and Secret scanning alerts.
- Keep Active ticked and save.
GitHub sends a test ping straight away. Under Recent Deliveries it should show a green tick (response 200). The first real event appears in your Vrymdor dashboard under Cloud and identity events.
For a single repository, do the same under that repository's Settings, then Webhooks.
Troubleshooting
| Response in Recent Deliveries | Meaning |
|---|---|
| 403 "signature does not match" | The webhook secret is not your current token (it may have been rotated). Paste the token again. |
| 403 "must name your workspace" | The ?tenant= part of the payload URL is missing. Copy the URL from your email. |
| 413 | The delivery was larger than 1 MB (a very large push). It is skipped; nothing else is affected. |
If your token is rotated, update the webhook secret with the new token.