Connectors security and privacy
When you connect GitHub, you sign in on GitHub’s own page and approve access there; Syntic never sees your GitHub password. The access token GitHub returns is encrypted before Syntic stores it, and Syntic refuses to store it at all if encryption isn’t possible.
What you are granting
GitHub’s approval page asks for two kinds of access:
- Your profile, so Syntic can show which account is connected.
- Your repositories, so you can browse them and pick files. GitHub grants this repository access as one bundle that covers private repositories too.
In a chat, Syntic only reads the files you tick in Add content from GitHub, and only when you select them. Those file contents then become part of that chat and follow the same data rules as anything else you type or paste. See How Syntic handles your data.
Disconnect and fully revoke access
Disconnect in Syntic stops Syntic from using the connection. To also cancel the token on GitHub’s side, remove Syntic from your GitHub account’s authorized apps.
Disconnect in Syntic
Open Settings → Integrations and select Disconnect on the GitHub row. You’ll see Integration disconnected.
Revoke on GitHub
In your GitHub account settings, open the list of authorized OAuth apps, find Syntic and revoke it.
Disconnecting in Syntic alone does not cancel the token on GitHub. Do both steps if you no longer want Syntic to have access, for example when you leave an organization or lose a device.
Protection during sign-in
Each connection attempt carries a one-time check value. If the value that comes back from GitHub doesn’t match, Syntic stops with OAuth state mismatch — possible CSRF attack and saves nothing. Start the connection again from the same browser tab.
Syntic Code
MCP servers you add to Syntic Code run on your computer under your control. Project servers need your approval before they start. See MCP servers.
Report a problem
For a security concern, see Report a security issue.