Configure Scan Settings for Code Assessment
Configure Code Assessment settings, including checks, automation triggers, branch behavior, auto-fix, and SBOM and AI-BOM exports.
Open the settings drawer from Modules -> Code Assessment by selecting a repository and clicking the settings icon.
Settings are saved per repository. Manual runs, schedules, and automatic scans use the saved settings for that repository.
Automatic scans run after matching GitHub pull request or push activity. They do not scan an unpushed local working tree.
Checks
Checks decide what Pentest Copilot should look for in the repository.
Vulnerable code paths
Finds risky code paths such as user-controlled data reaching database queries, command execution, file access, SSRF, XSS, deserialization, or similar sinks. Findings include affected files, evidence, impact, and remediation guidance.
You want source-code vulnerability review similar to SAST, but with exploitability context.
Open-source dependency risk
Reviews manifests and lockfiles for vulnerable packages, affected versions, CVEs, and upgrade guidance.
You need software composition analysis for third-party dependencies.
Leaked secrets and credentials
Detects committed API keys, tokens, private keys, cloud credentials, and similar secrets.
You want to catch credential exposure before it reaches production or long-lived branches.
Business logic and authorization
Reviews authorization boundaries and workflows for issues such as IDOR, tenant isolation gaps, role bypass, approval abuse, payment logic flaws, and unsafe state transitions.
You want deeper review of application behavior that simple pattern matching may miss.
Run AI Inventory with each scan
Maps AI/LLM usage, model providers, prompt surfaces, and inference locations during each scan.
You need visibility into AI usage for governance, review, or AI-BOM export.
Enable the checks that match the review outcome you need. For a first run, keep all checks enabled so the first result set becomes a baseline.
Automation
Automation controls when the GitHub App should start scans automatically.
Scan every pull request
Runs when a pull request is opened, reopened, marked ready for review, or updated. Results are reported back on that pull request.
Scans the latest commit on the pull request.
Scan pushes
Runs when commits are pushed to matching branches.
With no branch filter, pushes scan only the repository default branch.
Branch filters
Limits push-triggered scans to specific branches or branch patterns.
Use regular expressions such as main, release/.*, or feature/.+.
Use pull request scans when you want feedback before merge. Use push scans when you want continuing coverage on important branches after code is merged.
Branch filters are regular expressions matched against the full branch name. release/.* matches release/2026.07; release/* is not the same pattern.
Manual Runs and Branch Selection
Manual runs are started from Modules -> Code Assessment with Run Code Assessment.
If you leave the branch or commit field blank, Pentest Copilot scans the repository default branch shown in the table. If you enter a branch name, tag, or commit SHA, the run uses that branch, tag, or commit instead.
Manual run, branch field blank
The default branch shown in the repository table.
Manual run, branch name entered
That branch in GitHub.
Manual run, commit SHA entered
That exact commit.
Pull request automation
The latest commit on the pull request.
Push automation
The commit that was pushed, if the branch matches the branch filter. With no filter, only the default branch is scanned.
Auto-fix
Auto-fix controls what happens after Pentest Copilot confirms a finding is real and safe to patch automatically.
Off
Pentest Copilot does not generate patches. Findings remain as evidence and remediation guidance only.
Your team wants manual remediation or is still evaluating the module.
Suggest
Pentest Copilot marks confirmed findings that can be fixed automatically. A user chooses when to generate the patch.
Your team wants control before patches are created.
Auto PR
After confirmation, Pentest Copilot creates a patch branch and opens a GitHub pull request against the scanned branch.
Your team wants an automated remediation workflow for safe, fixable findings.
When enabled, fix pull requests can also be commented back on the triggering pull request so reviewers can follow the remediation path from GitHub.
Auto-fix does not mean every finding will receive a patch. Pentest Copilot only generates fixes for findings it confirms as fixable and safe to patch automatically.
SBOM and AI-BOM Exports
Open Modules -> Code Assessment -> SBOM after a completed assessment.
This page shows the repository inventory and the AI-BOM + SBOM verification result. Pentest Copilot cross-checks whether the software bill of materials and AI bill of materials are internally consistent before export.
The verification view helps confirm:
package totals and direct dependency totals match the collected inventory;
ecosystems are summarized consistently;
AI inference locations and AI component records are linked to evidence;
the AI file index is present when AI usage is found.
Download options are shown clearly on the SBOM page:
SPDX 2.3 JSON
Standards-aligned software bill of materials review, vendor requests, audit workflows, and compliance evidence.
CycloneDX 1.6 JSON
Dependency governance, security tooling ingestion, and supply-chain workflows that expect CycloneDX.
AI-BOM JSON
AI/LLM governance, model/provider review, prompt-surface review, and AI usage inventory.
Recommended Defaults
First repository baseline
Enable all checks, enable AI inventory, keep auto-fix Off or Suggest, and run the default branch manually.
Pull request security review
Enable Scan every pull request and keep auto-fix Suggest until the team is comfortable with generated patches.
Main branch monitoring
Enable Scan pushes and leave branch filters blank for default-branch-only coverage, or add filters such as main and release/.*.
Mature remediation workflow
Use Auto PR after your team has reviewed the quality of suggested fixes on representative findings.
Before Enabling Automation
Check:
the GitHub App has access to the intended repositories;
branch filters match the branches your team actually uses;
repository owners know where Code Assessment comments and pull requests will appear;
auto-fix mode matches your change-management process;
SBOM, CycloneDX, SPDX, and AI-BOM exports are reviewed by the right security or compliance owner.
Last updated