Quickstart

Install the grayhat GitHub App, choose repositories, and get your first security review on a pull request.

You need admin access to a GitHub organization or repository. There’s nothing to install locally.

Install the GitHub App

Open the install page and choose Only select repositories. grayhat asks for read access to code, and write access to pull requests and checks so it can comment and open fix PRs.

Let the onboarding scan run

Each new repository gets one deep scan of the whole codebase: every route, guard and dependency. This builds the security index that later reviews compare against.

Open a pull request

On every push, grayhat reviews what changed in security terms. Findings arrive as a review on the pull request, each with a proof of concept.

Merge the fix

For a confirmed bug, grayhat opens a separate fix PR. It only opens once the original exploit fails against the patched app and your test suite passes.

What a review looks like

A review shows up as a check run plus inline comments from grayhat[bot]:

acme/billing-api · PR #482 · src/routes/invoices.ts
CRITICAL  EXPLOIT VERIFIED  CWE-639
Any signed-in user can read any invoice

$ curl -H "Authorization: Bearer $TENANT_B" \
    https://api.acme.dev/invoices/inv_7Hq2
200 OK  {"customer":"tenant_a","total":"48,200.00"…}

✓ Fix PR #483 opened · exploit now returns 404 · 214 tests pass