Getting Started

Vuln Scanner combines deterministic security tools (Semgrep, Gitleaks, OSV-Scanner) with an AI code reviewer to find vulnerabilities that pattern-matching alone misses — missing authorization checks, session fixation, business-logic flaws — while still catching the mechanical stuff (leaked secrets, vulnerable dependencies) reliably and cheaply.

1. Create an account

Register with an email and password. Every account gets its own organization — the unit everything else (repositories, team members, billing, API keys) is scoped to.

2. Connect a Git provider

From Settings → Git Providers, connect either:

• GitHub — installs a GitHub App on your account or organization. You pick exactly which repositories it can see during the GitHub install flow.
• GitLab — an OAuth connection to your gitlab.com account, scoped to whichever projects you're at least a Developer on.

See Connecting Repositories for the full walkthrough of both.

3. Enable scanning on a repository

Connecting a provider doesn't turn scanning on by itself — nothing runs until you explicitly enable a repository from the picker screen you land on right after connecting (or later from Repositories → Manage repositories). This is deliberate: you decide what gets scanned, not the provider's default access grant.

4. Your first scan

Enabling a repository queues an initial full scan immediately. After that, scans trigger automatically:

Trigger	When
Push	Every push to the repository's default branch
Pull/Merge request	Opened, reopened, or updated
Scheduled	Once a day, if the repo hasn't been scanned recently (opt-out per repo)
Manual	"Rescan now" from the repository page
API	POST /v1/repositories/:id/scans — see Public API

Watch progress live from the repository page — a scan moves through cloning → static analysis → AI analysis → processing, typically finishing in well under a minute thanks to per-file AI result caching.

5. Review findings

Findings land on the Findings page with a severity (critical/high/medium/low) and a confidence level — AI-sourced findings are explicitly marked with how confident the model was, so a low-confidence "worth a look" finding never gets equal visual weight to a Gitleaks-detected secret you need to rotate right now.

From there: mark a finding fixed, ignored, or false positive; export the current view as Markdown, JSON, or SARIF; or generate an AI-suggested fix PR. See Findings & Fixes.