Start for free

Code Audit

Pull request scans

Pull request scans find a privacy risk before you merge it. Inth posts the results as a review on the pull request in GitHub. In the Dashboard, each pull request scan is a PR audit.

Every plan includes pull request scans. This includes the Free plan. Each scan uses Credits. Inth does not run full audits on a schedule. Pull request scans are the continuous option.

Turn on pull request scans

First, connect GitHub and link the repository to a project. Only an owner or admin can change repository settings.

  1. In the Dashboard, open Settings > Integrations.
  2. Next to GitHub, select Manage.
  3. Select the repository.
  4. Turn on Run audits on pull requests.
  5. To scan only some pull requests, enter target branches in Branch filters.
  6. Select Save repository.

You can also turn on pull request scans in the Pull requests section when you start an audit.

Separate branch filters with commas, such as main, release/*. A filter can use wildcards or a regular expression between slashes, such as /^hotfix\//. If you leave the field empty, Inth scans pull requests for every branch.

If more than 1 Inth organization links the same repository, the first organization to connect it controls pull request scans and ignored paths. The other organizations can still run full audits.

If 1 organization links the repository to more than 1 project, pull request scans use the first project that it linked.

Leave out files

Ignored paths keep files out of pull request scans. Use them to leave out documentation, fixtures, or other apps in a monorepo. Ignored paths do not change full audits.

  1. In the Dashboard, open Settings > Integrations.
  2. Next to GitHub, select Manage.
  3. Select the repository.
  4. In Ignored paths, enter 1 pattern on each line, such as docs/**.
  5. Select Save repository.

Patterns use wildcards. ** matches folders at any depth. If every changed file in a pull request matches an ignored path, Inth does not scan it.

When a scan runs

Inth scans a pull request when it opens, when it reopens, and when it becomes ready for review. Inth does not scan draft pull requests. A push to an open pull request does not start a scan. This keeps the cost of a busy pull request low.

The Code Audit check is named Inth in the checks list and in your branch rules.

After a push, the Inth check on the new commit is skipped and shows Code Audit not run. To scan the new commit, do one of these:

  • In the check, select Run scan.
  • In the check, select the GitHub Re-run button.
  • Comment @inth-agent review on the pull request.

A scan always reviews the latest commit of the pull request. If you push while a scan runs, Inth stops that scan. Inth then does not scan the new commit until someone asks for a scan.

A skipped check does not block the merge, even when your branch rules make the Inth check required.

If the branch filters leave out the base branch, or if Inth ignores every changed file, Inth posts no check. If your branch rules make the Inth check required, GitHub then waits for that check. The pull request cannot merge.

What a scan reviews

A scan reviews every file in the current diff of the pull request, after ignored paths. It does not audit the whole repository.

GitHub lists at most 3,000 changed files for a pull request. If a pull request changes more files, Inth does not scan it, because the scan cannot see the full diff. The Inth check is skipped and shows Code Audit not run: too many changed files. Inth uses no Credits for it. Inth posts this check even when every listed file is in an ignored path, because the files GitHub leaves out might not be. To get a review, split the change into smaller pull requests.

To read the results, see Pull request reviews.

Pull request scan Credits

Each successful scan uses Credits for its own AI usage. A scan that you run again is a new scan, so it also uses Credits. Inth adds no platform fee and no extra fee for a scan that you run again. Inth does not charge for a scan that fails or that it stops.

A scan needs a Credit balance above 0 to start. Inth records the final charge when it has the AI usage, even if the balance goes below 0. If the balance is 0 or less, Inth does not start the next scan. It posts a Code Audit skipped comment with an Add Credits link. After an owner adds Credits, select Retry scan in the check.

See Code Audit pricing for more about Credits.