Security review, handled. One GitHub App, one console. Reviews start at install. The owner can turn them off. The scan is there for the repository you already have. Paid plans are live in the console.
One install covers both products. For the scan, the App asks for Contents read, Metadata, and Checks write; you pick the repositories. Your organization accepts Pull-requests read and write at install, and PR reviews start on the next pull request, before anyone signs in (25 free private reviews a month). Then sign in to the console with GitHub; it connects the matching install automatically. Setup can turn reviews off and starts the selected first scan. Free organizations get two private scans in 14 days; paid organizations use their included scan allowance. No extra charge is authorized during setup. No second install.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.