How to Trigger a Code Assessment

Follow these steps to connect GitHub repositories and run a Code Assessment in Pentest Copilot Enterprise.

Code Assessment reviews source repositories connected through the Pentest Copilot GitHub App. It helps security and engineering teams find vulnerable code paths, risky dependencies, leaked secrets, authorization issues, business-logic weaknesses, and software/AI inventory gaps before code reaches production.

Code Assessment scans code available in GitHub. It does not scan unpushed local changes on a developer workstation.

Code Assessment Flow

1. Connect the GitHub App.

2. Select or connect repositories.

3. Configure repository scan settings.

4. Choose manual, scheduled, pull request, or push-triggered scans.

5. Review findings, fix pull requests, SBOM exports, and AI-BOM exports.

1. Connect the GitHub App

Open Settings -> Integrations -> GitHub or Modules -> Code Assessment and start the GitHub connection flow.

Configure GitHub for Code Assessment

During the GitHub installation:

• choose the GitHub organization or account that owns the repositories;

• grant access to all repositories or selected repositories;

• confirm the installation and return to Pentest Copilot.

If the GitHub App was already installed, confirm that the required repositories are included in the installation's repository access list.

You only need to install the GitHub App from Pentest Copilot. No separate GitHub App setup is required.

2. Select Repositories

Open Modules -> Code Assessment.

The repository table shows GitHub repositories that Pentest Copilot can access. Select one or more repositories to include in the run.

The Branch column shows the repository's default branch. If you start a manual run without entering a branch or commit, Pentest Copilot scans that default branch.

You can also connect a repository to a domain from the GitHub integration screen. Domain-connected repositories allow external findings on that domain to be patched against the matching source repositories.

Manual runs use the code currently available in GitHub. If a developer has local changes that are not pushed, those changes are not included.

3. Configure Scan Settings

Click the settings icon for a repository to open Scan settings.

Use scan settings to decide:

• which checks should run;

• whether GitHub pull requests or pushes should trigger automatic scans;

• which branches push scans should watch;

• what should happen when Pentest Copilot confirms a finding that can be fixed automatically.

Configure Scan Settings for Code Assessment

4. Run or Schedule the Assessment

After selecting repositories, click Run Code Assessment.

Before launch, review the selected repositories and choose a branch or commit if you want to scan something other than the default branch.

Run type	What gets scanned
Manual run with no branch entered	The repository default branch shown in the table.
Manual run with a branch entered	The named branch in GitHub.
Manual run with a commit entered	That exact Git commit.
Scheduled run	The saved run configuration at the time the schedule was created.
Pull request automation	The latest commit on the pull request.
Push automation	The commit that was pushed, if push scans are enabled and the branch matches the repository settings.

Use Schedule when the same repositories should be assessed on a recurring cadence.

5. Monitor the Run

Open Activity -> Activity to follow the module status.

The Activity page shows whether the assessment is pending, running, completed, failed, cancelled, or scheduled. If a run fails, start here before judging coverage.

Activity

6. Review Results

After assessment completes:

• open Modules -> Code Assessment -> Statistics for aggregate severity, category, and trend views;

• open Modules -> Code Assessment -> Attack Paths for validated findings and remediation guidance;

• open a finding detail page to review evidence, AI reasoning, affected files, fix guidance, status, and retest controls;

• open Modules -> Code Assessment -> SBOM to review inventory verification and download SPDX, CycloneDX, and AI-BOM exports.

Analysing Scan Results

Common Blocks

Block	What to check
GitHub App is not connected	Open Settings -> Integrations -> GitHub and complete the GitHub App installation.
Repository is missing	Confirm the repository is included in the GitHub App installation's repository access list.
Unsure which branch was scanned	Check whether the run used a manual branch or commit, the repository default branch, pull request automation, or push automation.
Pull request scan did not run	Confirm Scan every pull request is enabled for that repository and that the pull request was opened, reopened, or updated after the setting was saved.
Push scan did not run	Confirm Scan pushes is enabled and the pushed branch matches the branch filters. With no filter, only the default branch is scanned.
Auto-fix did not open a pull request	Confirm the finding is validated, fixable, and the repository is configured for Auto PR.
Inventory exports are unavailable	Confirm the assessment completed far enough to build the inventory, then open Modules -> Code Assessment -> SBOM.