Security scans
Scan a whole codebase for vulnerabilities on a schedule, after merges, on demand, from your terminal or from CI.
A review reads one diff. A scan reads the whole codebase, so it finds what was already there and problems that span several files. Every finding carries a severity and a CWE id.
In the dashboard
Open the repository and go to Security scans. Three switches decide when scans run and where the findings go.
| Switch | What it does |
|---|---|
| On a schedule | Every day, weekdays, or the days you pick, at any time in any time zone. The panel lists the next runs |
| After a merge into main | A full scan when a pull request merges. Scan at most every merge, hourly, every 6 hours or daily |
| Open GitHub issues | Files findings at or above a severity you choose, up to a set number per scan. Private repositories only, and each problem is filed once |
Scan now, at the top of the same tab, starts a scan straight away. Results appear in the Security Monitor. One scan per repository runs at a time.
From your terminal
patchlight scan --diffScans the files on your disk, uncommitted work included. No GitHub connection needed. See Scan in your terminal.
From CI or code
patchlight scan acme/checkout --wait --fail-on highScans a repository connected through the GitHub App, server side, and fails the job on severe findings. See CLI commands or the SDK.
Cost
A scan is billed by the model usage it takes, so cost follows the size of the codebase: cents for a
small library, dollars for a large monorepo. --diff and --path keep it small. A monthly
budget per repository and a monthly spend cap per workspace stop new scans once reached.