---
title: Pull request scans
description: Scan each pull request for new privacy risks before you merge it.
seoTitle: Scan pull requests with Inth Code Audit
seoDescription: Turn on Code Audit pull request scans, choose branches and
  ignored paths, and learn when a scan runs and what it costs in Credits.
lastModified: "2026-11-09T15:00:35Z"
---
Pull request scans find a privacy risk before you merge it. Inth posts the results as a review on the pull request in GitHub. In the Dashboard, each pull request scan is a **PR audit**.

Every plan includes pull request scans. This includes the Free plan. Each scan uses Credits. Inth does not run full audits on a schedule. Pull request scans are the continuous option.

## Turn on pull request scans

First, [connect GitHub](/docs/code-audit/connect-github) and link the repository to a project. Only an owner or admin can change repository settings.

1. In the Dashboard, open **Settings > Integrations**.
2. Next to **GitHub**, select **Manage**.
3. Select the repository.
4. Turn on **Run audits on pull requests**.
5. To scan only some pull requests, enter target branches in **Branch filters**.
6. Select **Save repository**.

You can also turn on pull request scans in the **Pull requests** section when you start an audit.

Separate branch filters with commas, such as `main, release/*`. A filter can use wildcards or a regular expression between slashes, such as `/^hotfix\//`. If you leave the field empty, Inth scans pull requests for every branch.

If more than 1 Inth organization links the same repository, the first organization to connect it controls pull request scans and ignored paths. The other organizations can still run full audits.

If 1 organization links the repository to more than 1 project, pull request scans use the first project that it linked.

## Leave out files

Ignored paths keep files out of pull request scans. Use them to leave out documentation, fixtures, or other apps in a monorepo. Ignored paths do not change full audits.

1. In the Dashboard, open **Settings > Integrations**.
2. Next to **GitHub**, select **Manage**.
3. Select the repository.
4. In **Ignored paths**, enter 1 pattern on each line, such as `docs/**`.
5. Select **Save repository**.

Patterns use wildcards. `**` matches folders at any depth. If every changed file in a pull request matches an ignored path, Inth does not scan it.

## When a scan runs

Inth scans a pull request when it opens, when it reopens, and when it becomes ready for review. Inth does not scan draft pull requests. A push to an open pull request does not start a scan. This keeps the cost of a busy pull request low.

The Code Audit check is named **Inth** in the checks list and in your branch rules.

After a push, the **Inth** check on the new commit is skipped and shows **Code Audit not run**. To scan the new commit, do one of these:

* In the check, select **Run scan**.
* In the check, select the GitHub **Re-run** button.
* Comment [`@inth-agent review`](/docs/code-audit/commands) on the pull request.

A scan always reviews the latest commit of the pull request. If you push while a scan runs, Inth stops that scan. Inth then does not scan the new commit until someone asks for a scan.

A skipped check does not block the merge, even when your branch rules make the **Inth** check required.

If the branch filters leave out the base branch, or if Inth ignores every changed file, Inth posts no check. If your branch rules make the **Inth** check required, GitHub then waits for that check. The pull request cannot merge.

## What a scan reviews

A scan reviews every file in the current diff of the pull request, after ignored paths. It does not audit the whole repository.

GitHub lists at most 3,000 changed files for a pull request. If a pull request changes more files, Inth does not scan it, because the scan cannot see the full diff. The **Inth** check is skipped and shows **Code Audit not run: too many changed files**. Inth uses no Credits for it. Inth posts this check even when every listed file is in an ignored path, because the files GitHub leaves out might not be. To get a review, split the change into smaller pull requests.

To read the results, see [Pull request reviews](/docs/code-audit/pull-request-reviews).

## Pull request scan Credits

Each successful scan uses Credits for its own AI usage. A scan that you run again is a new scan, so it also uses Credits. Inth adds no platform fee and no extra fee for a scan that you run again. Inth does not charge for a scan that fails or that it stops.

A scan needs a Credit balance above 0 to start. Inth records the final charge when it has the AI usage, even if the balance goes below 0. If the balance is 0 or less, Inth does not start the next scan. It posts a **Code Audit skipped** comment with an **Add Credits** link. After an owner adds Credits, select **Retry scan** in the check.

See [Code Audit pricing](/docs/pricing#code-audit-pricing) for more about Credits.