Github applications is showing browsing activity

@kunalgandhi this is likely because Instance is not detected until an activity occurs in the app.  There is no instance to detect on the initial navigation (Browse) to Github.  Do you have activities selected in the second policy or is it set to Any?  If it's set to Any, change it to explicitly select all activities you want to block outside of your instance.  This will allow the initial navigation but block the activities if the users accesses an unsanctioned instance.  You can further mitigate accessing unsanctioned instances by blocking the Login if they aren't using your corporate domains (see below).  My Corporate Domains User Constraint is for any domain that doesn't match my corporate domains:

The below policy then blocks logins that don't match my corporate domains:

 something appears to be working incorrectly or perhaps additional configuration is required.  Browse should only be blocked when activities aren't selected when an application is selected.  Would you be able to provide a screenshot of the policy and one of the Alerts it generated?  You can crop out or obfuscate any sensitive data.  

Check Application Events logged as Browse it's likely the user-agent is a cli based tool such as "git" for which Netskope will not be able to detect activity. If this is the case you may want to create a policy using Http Header regex for git to allow as needed to avoid the block.