Platform integrations

Last updated: Aug 4, 2026

---

Rationale

Integrations with source code providers, such as our GitHub App, are performed by an in-house implementation. Such implementation currently supports:

• Authenticating as the app to reach a client's installation.
• Receiving and dispatching provider events to the corresponding platform workflow.

The main reasons why we chose it over other alternatives are:

• The amount of code an in-house implementation replaces is small, so the maintainability gain from a third-party layer is limited.
• The credentials involved, such as an app's private key and its webhook signing secret, are the most sensitive secrets of the whole integration. Keeping them in-house keeps their custody and blast radius fully within our own trust boundary.

Alternatives

As the application evolved, so did our interest in using a third-party integration solution. Below are the ones we have reviewed, ordered from most to least interesting based on our specific needs.

Nango

• Nango provides a SaaS platform for managing third-party API integrations, including a dedicated flow for GitHub App-style integrations.
• Its GitHub App flow requires uploading the app's private key to their platform. That key is not scoped to a single client; it is the master credential used to authenticate as the app across every installation, indefinitely.
• Provider events would also need to be routed through Nango instead of directly to us, which means the webhook signing secret would move out of our direct control as well.
• What it automates on our behalf, minting short-lived installation tokens, is a small amount of code. We would still need our own logic to unwrap its payload and dispatch it to the corresponding workflow, so the integration code is not meaningfully reduced, only an extra network hop is added.
• For integrations that only involve classic OAuth, without an app-style master credential, the trade-off looks different and the maintainability gain could be worth revisiting.

Usage

We use an in-house implementation for provider integrations, such as our GitHub App, at Fluid Attacks' platform.

Other in-house dependencies

• Platform audit logs
• Platform authentication
• Platform authorization