Skip to main content

Run your first code audit

Connect a repository, run a code audit assessment, read the findings, and export a report. You finish with a completed code audit and structured vulnerabilities ready for remediation.

Prerequisites​

  • An AISafe account (see Create an account)
  • A GitHub or GitLab repository to audit (for private repos, install the AISafe GitHub/GitLab App)

Step 1: Connect your repository​

  1. Navigate to Integrations in the AISafe dashboard.
  2. Click Connect GitHub (or Connect GitLab) and authorize AISafe to access your repositories.
  3. Select the repositories you want to make available for scanning.

If your repository is public, skip this step and provide the URL when creating the assessment.

Step 2: Create the assessment​

  1. Click New Assessment in the dashboard.
  2. Enter a name (e.g. "api-gateway security audit").
  3. Select Code Audit as the assessment type.
  4. Choose your source:
    • Connected repository: select from the dropdown of repos your integration syncs.
    • Public repository URL: paste a public https://github.com/{owner}/{repo} URL.
    • Upload archive: upload a tar.gz of your codebase.
  5. You can add additional instructions to steer the agents (e.g. "focus on authentication and authorization vulnerabilities").
  6. Click Create draft.

Step 3: Start the assessment​

Review the draft configuration, then click Start assessment. AISafe validates the source (clones the repo, resolves the ref), then spins up isolated sandboxes and runs the AI agents.

AISafe streams progress through stages: Understanding → Analysis → Audit → Triage → Report. Depending on the size of your codebase, the assessment completes in minutes to a few hours. You can navigate away and come back. The assessment runs in the background.

Step 4: Read the findings​

The assessment completes, and you land on the findings list. Each finding shows:

  • Severity: critical, high, medium, low, or info
  • Title: a concise description of the vulnerability
  • Status: open, confirmed, not fixed, false positive, accepted risk, duplicate, or fixed. Not fixed and Fixed are results from verifying a submitted source revision.
  • Evidence: file locations, taint flows, code snippets, and proof-of-concept

Click any finding to see the full detail: the triage agent's reasoning, affected code locations, taint flow (source → propagators → sink), CWE/OWASP mapping, and remediation guidance.

Step 5: Triage findings​

Review each finding and decide:

  • Confirm: the vulnerability is real and needs fixing
  • False positive: the reported vulnerability lacks a real exploit path (provide a reason)
  • Accepted risk: acknowledge the vulnerability and defer the fix (provide a reason)
  • Duplicate: same root cause as another finding (link the canonical finding)

Step 6: Export a report​

  1. On the assessment detail page, click Generate report.
  2. AISafe compiles a PDF with an executive summary and per-finding details.
  3. Download the PDF or share the report URL with stakeholders.

You can export individual findings as issues to GitHub, Jira, or Linear (see Integrations).

Next steps​