Scheduled Scans
Only Code Audit schedules currently create new runs. Pentest and hybrid white-box schedule occurrences are rejected before credits are spent.
Scheduled scans are part of Pro. On a Free plan you can open the tab and read the cadence options, but a schedule cannot be saved. If you later move off Pro, existing schedules stay visible and you can still delete them. See Credits and billing.
Scheduled Scans let you configure recurring assessment cadences on a Project. You set a schedule and AISafe creates and runs assessments at the configured intervals.
How it works
- You configure one or more schedule entries on a project, each with a cadence and an assessment type.
- AISafe creates assessments at each scheduled interval.
- Each scheduled assessment runs like any other: it loads context from the project's living knowledge base, produces findings, and fires webhook events on completion.
A scheduled SAST scan costs nothing. It runs the same free static analysis as the on-demand scan, honours the same rescan window, and never touches your credits. Every other type is charged per occurrence, exactly as if you had started it by hand — the schedule editor shows which of the two you are choosing before you save.
Unchanged source is never billed twice. Before charging anything, AISafe compares your source against what the last completed run of that schedule already audited. If nothing changed, the occurrence is skipped and marked "No changes since last scan" — no credits spent, no rescan window consumed. The comparison is per schedule, so a daily SAST scan never hides new source from a weekly audit. A new commit always runs, even if its content is identical, and whenever AISafe cannot tell whether the source changed it runs the scan rather than skipping it.
Why schedule scans?
Scheduled scans are essential for maintaining an accurate security posture over time. Codebases change: new dependencies appear, new endpoints open, and patterns that were safe become vulnerable due to upstream changes. Regular scans catch these drifts before they become incidents.
Configuring a schedule
You configure schedules on the project's settings page. Each schedule entry specifies:
- Cadence: daily, weekly, every two weeks, or monthly, at an hour you pick (UTC). There are no cron expressions.
- Assessment type: SAST scan, code audit, or pentest.
- Source revision/ref: which branch or ref to scan (for code audits).
How often a type may run depends on what it costs. The free SAST scan is the only one that can run daily; everything charged to credits is weekly at its most frequent. A daily AI audit would be a large monthly bill nobody asked for, and a surprise invoice is a worse failure than a missing option.
See Guide: Set up scheduled scans for step-by-step instructions.