Skip to content
- PAT stored securely — The GitHub token is stored in etcd (encrypted at rest) and accessed only server-side. It is never exposed to the client.
- Organization-scoped — All searches are scoped to the configured organization. The agent cannot access repos outside the org.
- Repo exclusion — Specific repos or patterns can be excluded from search results via Admin UI configuration.
- No inbound endpoints — FluidRAG only makes outbound API calls to GitHub and Sourcebot. No webhooks or inbound endpoints are required.
- Admin UI OAuth is separate —
GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET are for Admin UI login via GitHub OAuth, not for the agent.