Skip to main content
You need to allowlist Borg IPs in two situations:
  • Live URL tests. The connectivity check detects a WAF, rate limiter or firewall blocking its requests to your application. A static analysis of connected repositories does not send traffic to your application.
  • GitHub IP allow lists. Your GitHub organisation or enterprise restricts access by IP address. See GitHub IP allow lists below.

​
Borg IP ranges

Add the following IP ranges to your allowlist:
The current IP list is also provided during onboarding.

​
GitHub IP allow lists

If your GitHub organisation or enterprise uses an IP allow list, GitHub refuses requests from addresses that are not on it. This includes requests made by the Odin GitHub App and by your personal GitHub connection in Odin. Typical symptoms are “Couldn’t connect that GitHub account” when you connect your personal GitHub account, missing repositories, or PR reviews that never start. Add both lists below to your GitHub IP allow list.
The Odin GitHub Apps also declare these addresses. If an organisation owner enables Allow access by GitHub Apps (Settings > Authentication security > IP allow list), GitHub adds them automatically, but only for requests the app makes as an installation. Connecting a personal GitHub account in Odin uses that person’s own authorisation, which GitHub does not cover with an app’s list, so add the Odin web app addresses to your own allow list as well.
The Odin web app addresses come from our hosting provider’s static IP pool. They are reserved for our project but shared at the network level with a small number of other customers of that provider. GitHub still requires valid credentials for every request.
Enterprise Managed User accounts are supported. If your identity provider enforces IP-based conditional access, allow the same addresses there.

​
Platform guides

  1. Log in to the Cloudflare dashboard and select your domain
  2. Go to Security > WAF > Tools
  3. Under IP Access Rules, click Add a rule
  4. Set Value to each Borg IP range
  5. Set Action to Allow
  6. Set Zone to apply to your specific domain (or all zones if needed)
  7. Click Add
Repeat for each IP range.
If you’re using Cloudflare’s Bot Fight Mode or Super Bot Fight Mode, you may also need to create a Configuration Rule that bypasses bot detection for these IPs.
  1. Go to the AWS Console > WAF & Shield > IP sets
  2. Click Create IP set
  3. Name it mjolnir-allowlist, select your region, and paste in the Borg IP ranges
  4. Go to your Web ACL > Rules > Add rule > Add my own rules
  5. Select IP set and choose the set you just created
  6. Set the action to Allow
  7. Set the rule priority high enough to evaluate before any blocking rules
Make sure the rule is set to Allow, not Count.
If you’re using Nginx’s limit_req module to rate-limit requests, you can exempt Borg’s IPs using the geo module:
Reload Nginx after making changes: nginx -s reload
If your application is behind an AWS Security Group or NACL that restricts inbound traffic:
  1. Go to EC2 > Security Groups and select the group attached to your application
  2. Click Inbound rules > Edit inbound rules
  3. Add a new rule for each Borg IP range:
    • Type: HTTPS (or the appropriate port)
    • Source: Borg IP range
  4. Save the rules
For Network ACLs, make sure both the inbound allow rule and the corresponding outbound rule for ephemeral ports are in place.

​
After updating your allowlist

Go back to the pentest setup wizard and click Re-run connectivity check. The status for your URLs should update to ✅ Reachable. If you’re still seeing issues after allowlisting, contact us at [email protected]. There may be additional layers of protection we can help you identify.