GitHub App
Plexon Sites
Publishes websites for your team into your own GitHub organization, so the people building them never need a GitHub account. If you landed here from the install screen, the part you want is directly below.
What It Asks For
Four repository permissions, no organization permissions, and no user permissions. The Administration one is worth reading properly, because on its own it looks like far more access than it is.
Creating the repository. This is the permission that reads most alarmingly, so: it is used by our server to call one endpoint, POST /orgs/{org}/repos. It is never included in any credential that reaches a desktop.
Pushing the built files, and the project source when the person publishing asks for it. This is the only write permission that ever leaves our server, and it arrives scoped to one repository.
Turning GitHub Pages on and setting the address. Server side only. A desktop copy cannot set a custom domain, which would otherwise be a way to claim a name belonging to someone else.
Mandatory for every GitHub App. Repository names and ids.
Never requested
Install it with Only select repositories and a single placeholder. Repositories Plexon creates are added to the installation automatically, so you lose nothing by doing that, and the app stays away from everything you already have.
What Happens When Someone Publishes
An owner installs the app on the organization, choosing "Only select repositories" and one throwaway repository. GitHub will not accept zero. Repositories Plexon creates later are added automatically, so the placeholder is never touched again.
Someone presses Publish in Plexon. Our server creates a repository in your organization, turns on GitHub Pages, and asks GitHub for a credential scoped to that one repository.
That credential goes to their machine and is used to push the built files straight to github.com, on a branch of their own. It works on one repository, carries one write permission, and expires after an hour.
The site is live at an address on plexon.website, or on your own domain if you would rather. Plexon checks the address actually answers before saying so.
Its owner can take it down at any time. Unpublish turns the site off and keeps the repository, so publishing again brings it back; Remove deletes the site and its repository on their explicit confirmation, which frees the name. Our server checks the signed-in user owns the site on every such call, and only your admins on plexon.ai can remove anyone else’s.
Worth Knowing
Credentials Last an Hour
Every credential Plexon issues is minted for one repository, with one write permission, and expires after 60 minutes. There is no long-lived token anywhere: not on our server, not on disk, not in a backup. Uninstalling the app invalidates outstanding ones immediately, at GitHub’s end rather than ours.
It Cannot Add a Workflow
No credential Plexon issues carries the Workflows permission, so GitHub itself rejects any push that touches .github/workflows. That is enforced by GitHub, not by our code, and it is what stops a published site from becoming a way to run code inside your organization. Managed sites use branch-based Pages and ship no workflow file at all.
The Repositories Are Yours
They are created in your organization, under your account, in your audit log. You own them and their contents. Plexon holds no copy. Delete a repository and it is gone; the app cannot recreate it on its own.
Published Sites Are Public
A private repository does not make a private website. GitHub Pages serves the built files to anyone with the address, and search engines will find them. Say this to whoever is publishing, because it is the mistake that matters: nothing confidential belongs in a folder that is about to be published. The same goes for the project source, which Plexon uploads only when someone turns that on, and which carries the whole git history of that folder when they do.
Removing It Takes One Click
Organization settings, GitHub Apps, Uninstall. No email, no support ticket, no notice period. Publishing stops working immediately and every repository stays exactly where it is.
Nobody Needs a GitHub Account
That is the point of the whole thing. A person publishing a site does not sign in to GitHub, does not create a token, and never sees one. They press Publish. Whether they are allowed to is decided by your Plexon administrator, per person or per group.
What We Recommend
Create a separate organization for this, rather than installing on the one holding your source. It costs nothing on GitHub’s free plan and it puts every risk in a container with no source, no secrets, no runners and no cloud trust policies in it. We would rather you did that than trust the permission list above.
Then verify the domain for that organization, which takes one DNS record and stops any other GitHub account claiming an address under it. Your Plexon administrator has the steps and does half of it.