Questions people ask before they connect a repo

Andesyte Code Security reviews changed code for security issues and brings findings into your review workflow, with context and suggested fixes. It works with GitHub pull requests and GitLab merge requests. The product page shows the review surfaces; the documentation covers how they work.

No. Automated findings help reviewers investigate security issues; they do not prove a system is secure. Your team still decides what to change and merge. For a focused review of a broader system, see our security review services.

Open Connect and choose your source host and workspace, then complete the installation flow. Follow the quickstart for your first review, or the GitLab guide for project linking.

Not to get started. Optional repository configuration and instruction-file suppressions let you tune review behaviour. See the configuration guide for the supported settings and how they are applied.

Public repositories have a free plan. Paid options support private repositories and measured usage. Current prices and plan details live on the pricing page; the billing guide explains how subscriptions and usage work.

Your workspace's billing page shows usage, plan controls and applicable limits. See the billing guide for how measured usage and limits affect new work.

Use your workspace's billing controls to manage subscriptions and available usage options. The billing guide describes supported transitions; the app shows which options are available to you.

Review data is processed to deliver the product. Findings and operational metadata support audit history and product operations. Read our security practices and privacy policy for data handling, providers and retention, and the DPA.

Andesyte does not train its own models on customer code. Upstream model-use controls and provider details are described in our security practices and privacy policy. Review those terms for your requirements before connecting a private repository.

Treat it as a starting point for investigation. Read the code context and explanation, verify the impact in your system and review any suggested fix before applying it.

Add context in the review thread. Eligible findings can be suppressed for future reviews, subject to permission and severity checks. The false positives and Learnings guide explains commands such as @andesyteoss ignore and their limits.

You can reply to an inline finding with @andesyteoss and your question. The documentation covers available commands and review workflows.

Yes. We run focused reviews across applications, cloud infrastructure, source control and release pipelines. See how our security reviews work.

Bug or feature request: use the contact form. Security vulnerability: use vulnerability disclosure instead.