Docs
Sign in
Documentation

Code Audit

Inth Code Audit finds code-evidenced privacy and data-protection risks in a repository. It combines deterministic code signals with investigation of the surrounding data flow, then produces findings that engineering, privacy, security, and legal teams can review.

Code Audit can identify areas such as:

  • personal or sensitive data written to logs and observability tools
  • analytics, advertising, replay, or identity tools loaded before consent
  • retention, deletion, DSAR, and data-export gaps
  • personal data sent to vendors, webhooks, CRMs, or AI services
  • privacy-relevant changes introduced by a pull request

Code Audit does not make final legal conclusions. Its findings are evidence for review.

Before you start

You need:

  • an Inth organization and project
  • an organization owner or admin who can connect the Inth GitHub App
  • access to the repository you want to audit
  • enough Inth Credits for the audit you want to run

Adding the project's production website and public policy pages is recommended. This gives Code Audit context about your disclosures and intended privacy controls, but it does not block a scan.

Try the free audit preview

Every organization can run a free Code Audit preview. The preview runs a real audit and shows a subset of the findings; the rest stay locked. The report tells you how many findings are locked, and you can unlock the full report with Credits using the quote shown on the report page.

One free preview exists at a time: the next one becomes available after you unlock the previous report.

Use the preview to see what Code Audit finds in your repository before paying for a full audit.

Connect a repository

  1. In the Inth dashboard, open Audit.
  2. Open the project that owns the code.
  3. Under Code, select Connect GitHub.
  4. Complete the GitHub App installation and choose the repositories Inth may access.
  5. Return to the project and link a repository.
  6. Set the Root directory. Use / for the whole repository or a subdirectory for one app in a monorepo.
  7. Set the production branch if it is not the repository default.

The App reads repository contents to audit code and writes pull request check runs and review comments to publish scan results. It also requests write access to repository contents and pull requests, which Code Audit uses to push a suggested fix as a branch or open a fix pull request. GitHub lists the exact permission scopes on the installation screen, and repository access can be managed later from the project's Code settings.

If a repository does not appear when linking, open the Inth App's settings in your GitHub organization and grant it access to that repository.

Add policy context

Policy context helps Code Audit compare code evidence with the controls and disclosures intended for the product.

From the project's Audit page:

  1. Add the production website.
  2. Add public pages such as your privacy policy, cookie policy, terms, or subprocessor list.
  3. Save the website and policy pages.

Keep these URLs current. Inth reads policy context from the active website connected to the project.

Run a full repository audit

  1. Open Audit and select Run audit.
  2. Choose the connected repository.
  3. Confirm that it is linked to the correct project and root directory.
  4. Select Get quote.
  5. When planning finishes, review the Credit quote and planned file count.
  6. Select Start full audit.

Planning is free. The full audit starts only after you approve the quote. Inth prevents another full audit from starting for the same repository while one is already active.

Use Audit → All audits to monitor queued, running, investigating, and completed audits or to return to a quote that is ready for approval.

Time and Credit expectations

Full Code Audits are one of the more Credit-intensive operations in Inth. Repository size, the selected scope, and the amount of privacy-relevant code all affect the work required.

Large or complex repositories can take more than an hour to complete. Use a project root directory to avoid auditing unrelated apps in a monorepo, and check the quote before starting the full run.

The dashboard shows a Credit quote for the planned scope before you approve the full audit.

Configure pull request scans

Pull request scans are part of continuous Code Audit monitoring, which requires the Startup plan. Organizations on the Free plan can run manual audits but cannot enable pull request scans.

To review changes before merge:

  1. Open Integrations and select the connected repository, or open the repository settings from the Run audit sheet.
  2. Enable Scan pull requests.
  3. Optionally add PR branch filters such as main or release/*, one per line.
  4. Optionally add ignored PR paths such as docs/**, one path or glob per line.

Branch and path filters support wildcards, including ** for nested directories. Leave the branch field empty to scan pull requests for every branch.

Pull request automation is managed by the first Inth organization that connected the repository. Other linked organizations can still run manual audits. Scheduled full-repository Code Audits are not available; pull request scans are the continuous option.

Each pull request scan reviews the files GitHub currently includes in the PR diff after project-root and ignored-path filtering. It does not rescan the whole repository, but it does review the full current PR diff rather than only files from the latest push. The report identifies the commit that was reviewed.

Pull request scan Credits

Each pull request scan charges a platform fee plus the run's AI provider cost. The platform fee is charged per pull request rather than per scan, and repeat scans of the same pull request cost less. The first scan on a pull request reserves the full 150-Credit fee cap up front, and unused Credits are released when the run finishes. If the balance cannot cover a completed scan, the report stays locked until an owner adds Credits; Inth then publishes the existing report without running the audit again.

See Code Audit pull request pricing for the fee amounts and worked examples.

Review the report

A completed report identifies the repository, branch, commit, and scanned directory. Findings can include:

  • priority and review state
  • affected files and source lines
  • supporting source evidence
  • the relevant data flow or control area
  • remediation or review guidance

Start with critical and high-priority items, but treat priority as potential impact rather than proof of a legal violation. Review the cited code in context, confirm assumptions with the code owner, and record whether the finding is confirmed, fixed, not evidenced, or accepted as a risk.

If investigation coverage is incomplete, the report says so. Retry the audit before treating missing findings as evidence that the repository is clear.

What a finding looks like

An illustrative example:

Customer email addresses written to application logs during checkout (high priority)

apps/shop/src/checkout/confirm.ts:84 passes the full customer object, including email and shippingAddress, to the request logger. The logger transport ships to a third-party observability tool, so personal data leaves the application outside the documented data flow. Cited evidence: the logging call, the transport configuration, and the observability destination.

Suggested review: log the order ID alone or redact the personal fields, and confirm the observability tool's retention window.

A real finding carries the same parts: a plain-language claim, a priority from critical to low, the affected files and lines, the cited evidence, and remediation or review guidance.

How Inth handles your code

Repository copies used during an audit are temporary and subject to Inth's deletion controls. Inth does not keep a lasting copy of your repository. It keeps the report: the findings, their cited evidence excerpts, and the metadata that identifies the repository, branch, commit, and scanned directory.

The investigation runs AI models through Inth's AI gateway, so the code under analysis and its surrounding context are sent to the model provider to produce findings. Inth has zero data retention (ZDR) agreements with its model providers.

Coverage and limitations

JavaScript and TypeScript have the broadest validated analysis coverage. Go, Python, Astro, Vue, and Svelte coverage is preview-stage, and some privacy-relevant behavior may require manual review.

Code Audit can miss behavior hidden behind runtime configuration, external systems, generated code, or unsupported languages. A clean report is not a compliance certificate or a guarantee that every privacy risk has been found.