Getting started
Sign in with GitHub, audit your first repository or code snippet, and understand what CodeAuditAgent gives you back.
CodeAuditAgent reads your source code the way a security reviewer would, and hands back a structured report: each finding quotes the code it is about, maps to a CWE, explains the impact and ships a concrete fix. This page takes you from nothing to your first report.
1. Sign in with GitHub
Authentication runs through GitHub. We request the minimum scope needed to read public repository contents; we never ask for write access, and we never push commits, open pull requests or change repository settings. You can revoke the authorisation from your GitHub settings at any time.
2. Choose what to audit
There are two ways in, and they produce the same kind of report:
- A GitHub repository URL, like https://github.com/owner/repo. We read the default branch of a public repository.
- A code snippet pasted into the dashboard, when you want a second opinion on one file or one function.
A repository you audit is tracked from then on, so its risk trend and audit history build up over time. A snippet is a one-off and is not tracked.
3. Run the audit
The audit runs in the background. You get an audit id immediately and the dashboard polls for the result, so you can close the tab and come back: a repository audit usually takes between thirty seconds and a few minutes, depending on how much source there is to read.
When it finishes, you get an email in the language you were using, with the risk score, the severity breakdown and a link straight to the report. You can turn that email off in Settings.
4. Work through the report
Open the report and start at the top: the summary and risk score tell you whether this is a quiet week or a bad one. Then work down the findings, which are ordered by severity. Each one carries the evidence from your code, the steps to fix it, and how to check that the fix worked.
What to do next
- Turn on a recurring audit for the repository so it re-checks itself every week without you remembering to.
- Add the products and libraries you depend on to your CVE watchlist, so you hear about their vulnerabilities early.
- Dismiss anything you judge a false positive; it stays dismissed through later audits.