Frequently asked questions

It looks for exploitable security problems: injection, broken access control, secrets in code, SSRF, XSS, unsafe deserialization, weak cryptography, logic flaws, race conditions and resource leaks. Style issues are out of scope.

Not by URL yet. Repository audits currently read public repositories. Private access through a GitHub App is on the roadmap. Meanwhile you can paste private code as a snippet.

Usually one to three minutes, depending on repository size. Audits run in the background and the dashboard updates when the report is ready.

Not yet. Pull-request review comments are on the roadmap. Today you run audits from the dashboard and export reports as Markdown or CSV.

Treat them as strong leads written by a careful reviewer. Every finding quotes its evidence and states its confidence. You should still review each patch before merging it.

Yes, any reviewer can. Audits are bounded by a file budget, and a partial snapshot is labeled as partial. CodeAuditAgent complements tests, dependency scanning and human review; it does not replace them.

No. We fetch your code for the audit and send it to the model, then store the report. The report quotes the relevant lines of code as evidence.

No. Code is sent to Anthropic through their commercial API, which does not use it for training.

Go to Settings and choose Delete account. Your account, repositories and reports are removed immediately. Cancel an active subscription first, and download a JSON export if you want a copy.

Yes: one repository and three audits a month, no credit card needed.

Yes. Cancel from Billing and your plan stays active until the end of the paid period. Payments are not refunded except where the law requires it.

New audits pause until the first day of the next month (UTC), or until you upgrade. Existing reports stay available.