Skip to main content

Prepare your repository

You give AISafe your source in one of three ways. The agents extract the code into an isolated environment, build a code graph from it, and retain no access to your repository after the audit finishes.

Source options​

Connected repository — select a private repository from your GitHub or GitLab integration. AISafe mints a short-lived, repository-scoped installation token to clone the code at the revision you specify. AISafe discards the token after the audit completes and keeps no persistent access.

Public repository URL — enter a public https://github.com/{owner}/{repo} URL. AISafe clones the default branch (or a specific commit or branch if you provide one). This is the quickest way to audit an open-source project.

Uploaded archive — upload a tar.gz of your codebase. This suits code not in a supported git host, or a specific snapshot you have not pushed to a remote. Include the full project tree so the agents can resolve cross-file dependencies.

The code graph resolves dependencies, so you do not need to install packages or run a build before uploading.

Before you start​

  • Connect the integration once, if you plan to audit private repositories. See Integrations and Integrations.
  • Decide the revision. Pick the branch, ref, or a specific commit to audit.
  • Add instructions, if useful, to steer the agents. See Steer the audit.
  • Check credit balance. Each audit consumes credits based on size and duration; you see the estimated cost before starting.

Vulnerable dependencies​

When dependency metadata lists exact versions, AISafe checks those packages against OSV. Vulnerable dependencies are promoted to first-class SCA findings, mapped to OWASP A06:2021 Vulnerable and Outdated Components and CWE-1395 by default. These are presence-based advisory findings: triageable, reportable, and exportable, but they do not claim the vulnerable function is reachable unless a separate code finding proves it.