Platforms
GitHub
Install the GitHub App, choose repositories, and understand the permissions it asks for.
The Audit Bench Ai GitHub App is the recommended way to use Audit Bench Ai on GitHub. Reviews post as the Audit Bench Ai bot, with a check you can make required and a Re-run button.
Install the App#
- 1
Connect GitHub in the app
Open Repository scan and connect your GitHub account. This is how Audit Bench Ai knows which installations belong to you.
- 2
Click Install on GitHub
On the Audit Bench Ai GitHub App card, click Install on GitHub, choose the account or organization and the repositories, and confirm.
- 3
Check the installation
GitHub sends you back to the app, where the installation is listed with an automatic review switch. Leave it on to review every new pull request.
When a review runs#
- A pull request is opened or reopened.
- New commits are pushed to it.
- A draft is marked Ready for review.
- Someone clicks Re-run on the Audit Bench Ai check.
Nothing runs for:
- Draft pull requests.
- A commit that has already been reviewed (GitHub sometimes delivers the same event twice).
- Pull requests opened by bots.
- Installations with automatic review switched off, or that GitHub has suspended.
Permissions#
The App asks for the least it needs to read code and leave a review:
| Permission | Access | Used for |
|---|---|---|
| Contents | Read | Reading the changed files and the code that calls them |
| Pull requests | Read and write | Posting the review, inline comments and replies |
| Checks | Read and write | The Audit Bench Ai check and its annotations |
| Metadata | Read | Required by GitHub for every App |
It listens for pull request, review comment, issue comment and check run events. It can’t push code, change settings, or see repositories you didn’t select.
The Audit Bench Ai check#
Each reviewed commit gets a check named Audit Bench Ai. It shows “Reviewing…” while it runs, then one of:
| Result | When |
|---|---|
| Failure | A critical finding, a high-severity security finding, merge conflicts, failing CI, or a likely secret added |
| Neutral | High or medium findings worth a look, but nothing blocking. Counts as passing |
| Success | No issues in the changed lines |
If a review can’t finish, because of a temporary error or a plan limit, the check closes as neutral with the reason, so it never blocks a merge or spins forever. Up to 50 findings also appear as annotations in the Files changed tab.
Re-run#
Click Re-run on the check, in the pull request’s Checks tab, to review the latest commit again. This is useful after changing your rules, or if a review didn’t finish.
Asking about the whole pull request#
Mention @auditbench in a pull request comment to ask a question, for example “@auditbench is this migration safe to run on a live table?”. It answers in the conversation, and if the answer is about a specific spot in the code it also opens a thread there. See Replies and reactions.
Without the App: a repository webhook#
If you can’t install Apps on an organization, you can connect a single repository with a webhook and a personal access token instead. Reviews then post as your own GitHub account, marked as automated.
- In Repository scan, connect a GitHub token with the
reposcope (or a fine-grained token with Contents: read). - Under Webhooks, add a webhook for the repository (
owner/repo). Copy the payload URL and the secret; the secret is shown only once. - On GitHub, open the repository’s Settings → Webhooks → Add webhook. Paste the URL, set the content type to
application/json, paste the secret, and choose Pull requests, Issue comments and Pull request review comments.