---
title: Introduction
description: grayhat is an AI gray hat for your own codebase. It indexes your repo, hunts it like an attacker, proves each exploit in a sandbox, then opens the pull request that fixes it.
---

grayhat attacks your code before someone else does. Install the GitHub App on the repositories you choose, and on every pull request it:

1. **Indexes** the change into security facts: routes, guards, data flows, dependencies.
2. **Hunts** it like an attacker, including the logic bugs no rule can match.
3. **Proves** each lead by exploiting your app inside an isolated sandbox. Never production.
4. **Reports** only what it could break, with a reproduction on the pull request.
5. **Fixes** it: a fix PR opens only when the exploit stops working and your tests pass.

:::note
grayhat only ever touches repositories where you installed the app. That consent line is what makes an exploit-writing agent a defensive tool. See [Security and data](/docs/security).
:::

## Why exploits, not alerts

Static scanners flood you with "potential" issues, and false positives are what make teams stop reading them. grayhat runs the attack. If the exploit fails, you never hear about it. If it works, you get the request that broke it and a patch that's already been tested.

## Where to go next

**[Quickstart](/docs/quickstart)**

Install the app and get your first review in minutes.

**[How it works](/docs/how-it-works)**

Index, diff, hunt, fix: the loop behind every review.

**[Findings](/docs/findings)**

Read a finding: severity, proof of concept and the fix PR.

**[Credits](/docs/credits)**

What each review, scan and fix costs.