FAQ
What kinds of repositories can I audit?
Any repository you can reach one of three ways: a private repository from your GitHub or GitLab integration, a public https://github.com/{owner}/{repo} URL, or an uploaded tar.gz archive. The agents support Python, JavaScript/TypeScript, Go, Rust, Java, Kotlin, C++, C#, Ruby, PHP, and more.
How long does an audit take?
It depends on the size and complexity of the codebase. Larger repositories with more files and deeper call graphs take longer. The audit runs in the background and streams progress, and you can leave the page and come back.
Does AISafe keep access to my repository after the audit?
No. For connected repositories, AISafe mints a short-lived, repository-scoped token to clone the code and discards it when the audit completes. The agents retain no access after the audit finishes.
What is the false-positive rate?
The triage pass keeps it low. A separate triage agent re-examines each finding's evidence, confirms or rejects it, deduplicates findings sharing a root cause, and assigns a confidence score. Low-confidence findings are flagged for your review. Your team still makes the final decision on each finding's status. See Triage.
Can I see the exact code that is vulnerable?
Yes. Each finding includes the vulnerable locations (file, function, line range), the taint flow from source to sink, and a proof-of-concept description. See Findings.
What happens with my dependency manifests?
When dependency metadata lists exact versions, AISafe checks the packages against OSV. Vulnerable dependencies become first-class SCA findings with a suggested upgrade path. They are presence-based: AISafe does not claim the vulnerable function is reachable unless a separate code finding proves it.
Can I focus the audit on a specific concern?
Yes. Provide additional instructions when you start the audit to steer the agents, for example toward payment code or a specific compliance requirement. See Steer the audit.
What formats can I get beyond the report?
You can download findings in machine-readable formats (SARIF, OpenVEX, JSON, CSV) and export a CycloneDX or SPDX SBOM. See Concepts: Finding and SBOM export.
How much does an audit cost?
Each audit consumes credits based on its type, the size of the target, and the selected duration. You see the estimated cost before starting, and AISafe refunds credits if the assessment fails due to a platform error. See Credits & billing.