---
title: Quickstart
description: Install the grayhat GitHub App, choose repositories, and get your first security review on a pull request.
---

You need admin access to a GitHub organization or repository. There's nothing to install locally.

1. **Install the GitHub App**

    Open the install page and choose **Only select repositories**. grayhat asks for read access to code, and write access to pull requests and checks so it can comment and open fix PRs.

2. **Let the onboarding scan run**

    Each new repository gets one deep scan of the whole codebase: every route, guard and dependency. This builds the security index that later reviews compare against.

3. **Open a pull request**

    On every push, grayhat reviews what changed in security terms. Findings arrive as a review on the pull request, each with a proof of concept.

4. **Merge the fix**

    For a confirmed bug, grayhat opens a separate fix PR. It only opens once the original exploit fails against the patched app and your test suite passes.

## What a review looks like

A review shows up as a check run plus inline comments from `grayhat[bot]`:

```txt
acme/billing-api · PR #482 · src/routes/invoices.ts
CRITICAL  EXPLOIT VERIFIED  CWE-639
Any signed-in user can read any invoice

$ curl -H "Authorization: Bearer $TENANT_B" \
    https://api.acme.dev/invoices/inv_7Hq2
200 OK  {"customer":"tenant_a","total":"48,200.00"…}

✓ Fix PR #483 opened · exploit now returns 404 · 214 tests pass
```

:::tip
Docs-only and formatting-only pull requests are skipped and cost nothing. A new push to the same pull request cancels the old run, so you pay once.
:::