FAQ

What kinds of repositories can I audit?

Any repository you can reach one of three ways: a private repository from your GitHub or GitLab integration, a public https://github.com/{owner}/{repo} URL, or an uploaded tar.gz archive. The agents support Python, JavaScript/TypeScript, Go, Rust, Java, Kotlin, C++, C#, Ruby, PHP, and more.

How big a repository can I audit?

Up to 300 MB of compressed source, 100,000 files, and 1,000,000 lines of code in one audit. Beyond that, scope the audit to the part of the repository you care about, or talk to us — we size larger runs for customers who need the whole tree read at once.

How long does an audit take?

It depends on the size and complexity of the codebase. Larger repositories with more files and deeper call graphs take longer. The audit runs in the background and streams progress, and you can leave the page and come back.

Does AISafe keep access to my repository after the audit?

No. For connected repositories, AISafe mints a short-lived, repository-scoped token to clone the code and discards it when the audit completes. The agents retain no access after the audit finishes.

What is the false-positive rate?

The triage pass keeps it low. A separate triage agent re-examines each finding's evidence, confirms or rejects it, deduplicates findings sharing a root cause, and assigns a confidence score. Low-confidence findings are flagged for your review. Your team still makes the final decision on each finding's status. See Triage.

Can I see the exact code that is vulnerable?

Yes. Each finding includes the vulnerable locations (file, function, line range), the taint flow from source to sink, and a proof-of-concept description. See Findings.

What happens with my dependency manifests?

AISafe reads manifests and lockfiles locally and keeps dependency, declared licence, and SBOM facts in the scan artifact. The pricing scan is offline and does not query OSV or package registries. An advisory claim requires separate audit evidence; absence from the local inventory is not a safety claim.

How do I know a class of vulnerability was actually checked?

Read the coverage record. The audit walks a methodology checklist and answers every check on it: tested here, already answered by other work in the run, not applicable to your application with the reason, or out of reach because the check needs a running system. An empty findings section and an unexamined class are different things, and the record tells you which one you are looking at. See Coverage.

What do the GDPR, HIPAA, and PCI DSS options do?

Ticking one adds that regime's checks to the methodology checklist, along with the recognition ability those checks need, such as spotting personal data in your code. The two arrive together and cannot be selected apart. The checks cover the technical articles a code audit can speak to and leave out the obligations answered by a document rather than by code, such as staff training, processor contracts, and breach-notification timelines. An audit with a regime ticked is not an assessment of compliance, and AISafe is not an assessor. See Coverage.

Can I focus the audit on a specific concern?

Yes. Provide additional instructions when you start the audit to steer the agents, for example toward payment code or a specific compliance requirement. See Steer the audit.

What formats can I get beyond the report?

You can download findings in machine-readable formats (SARIF, OpenVEX, JSON, CSV) and export a CycloneDX or SPDX SBOM. See Concepts: Finding and SBOM export.

How much does an audit cost?

Code-audit price comes from exact LOC and token units after offline analysis and snapshot validation. Fixed-price assessment types use their catalogue price. AISafe shows the final cost before Start and refunds credits if an assessment fails due to a platform error. See Credits & billing.