Skip to main content

Prepare your repository

You give AISafe your source in one of three ways. The agents extract the code into an isolated environment, build a code graph from it, and retain no access to your repository after the audit finishes.

Source options​

Connected repository — select a private repository from your GitHub or GitLab integration. AISafe mints a short-lived, repository-scoped installation token to clone the code at the revision you specify. AISafe discards the token after the audit completes and keeps no persistent access.

For a code audit linked to a Project with a connected repository, choose either a saved Project version or a Remote branch. A remote branch is fetched and pinned to an exact commit for that audit. Choosing the Project's tracked repository branch updates its tracked version and lets the audit update Project knowledge. Any other branch can use existing Project knowledge but cannot change it. Remote-branch selection is not shown for archive or public-URL Projects because they have no connected installation that can authorize the branch list.

Public repository URL — enter a public https://github.com/{owner}/{repo} URL. AISafe clones the default branch (or a specific commit or branch if you provide one). This is the quickest way to audit an open-source project.

Uploaded archive — upload a tar.gz of your codebase. This suits code not in a supported git host, or a specific snapshot you have not pushed to a remote. Include the full project tree so the agents can resolve cross-file dependencies.

The code graph resolves dependencies, so you do not need to install packages or run a build before uploading.

Before you start​

  • Connect the integration once, if you plan to audit private repositories. See Integrations and Integrations.
  • Decide the revision. Pick the branch, ref, or a specific commit to audit.
  • Add instructions, if useful, to steer the agents. See Steer the audit.
  • Check credit balance. Each audit consumes credits based on size and duration; you see the final price before starting.

AISafe shows the final price only after the offline source scan has finished and its saved result has passed integrity checks. The source picker shows no provisional byte-based price. Recoverable parser limits may be listed with a valid partial result when the saved counters account for every unreadable or quarantined file. Those files reduce the reported coverage; they do not discard the code AISafe could analyse. A corrupt artifact, unexplained partial result, hard resource limit, or internally inconsistent scan shows no price and cannot be started; fix the reported source problem or retry validation.

What one audit covers​

Source archiveUp to 300 MB compressed
FilesUp to 100,000
CodeUp to 1,000,000 lines

Larger than that? Scope the audit to the part of the repository you want read — most codebases have one — or talk to us and we will size a run for the whole thing.

Two file-level details worth knowing: single files over 2 MB are inventoried but not parsed (they are almost always bundles, lockfiles, or vendored blobs), and anything skipped is reported in the audit's coverage rather than passed over in silence.

Dependency inventory​

AISafe reads manifests and lockfiles locally to build dependency, licence, and SBOM facts. The pricing scan makes no OSV, package-registry, or provider calls. An exact version in the inventory therefore does not claim that the package is free of advisories; vulnerability applicability still needs audit evidence.