You can also just do an external pentest -- Github is for continuous CI/CD coverage