Guide

GitHub repository security scan — public or private, no upload

Short answer

Hackaiz scans a GitHub repository directly through a GitHub App you install on chosen repositories — nothing is uploaded by hand. Public and private repositories are analysed only when you have authorized them through the app. Each finding links to the file and line, and fixes arrive as pull requests you approve.

By the Hackaiz team · HACKTUALIZ Inc. · Updated 2026-10-21

Start my first scan

Public vs private repositories

Public: install the Hackaiz GitHub App on it, like a private one; arbitrary repository links are not accepted.
Private: click Connect GitHub, pick the repositories, and Hackaiz reads only those.
You can remove access at any time from GitHub settings.

Quick or Deep

Quick reviews the most important files first. Deep tries every eligible file and explains clearly which checks could not run and why. Automatic picks every compatible check family, including AI security; Choose lets you select families yourself.

Adding the live site

If you give the address of your deployed site and prove you control its domain, the repository scan also runs external checks on that address. Hackaiz never guesses a deployment address from the code.

Fixes you review

Approved fixes are opened as pull requests. You review and merge them yourself; Hackaiz never merges or changes your main branch.