Guide
How jeerc scans a repository outside your pipeline
What happens between connecting GitHub and seeing a finding, and what jeerc can and cannot touch along the way.
Step by step
- Install the GitHub App. It reads repository contents and metadata, read-only, for the repositories you pick. Nothing is ever merged automatically.
- Set the schedule. Per repository or per team, in your timezone. Your first scan is queued as soon as you pick a repository.
- Clone with a short-lived token. Each scan clones the repository with a GitHub App token that lasts one hour.
- Scan offline. The SAST, SCA, IaC and secret scanners run with no network access.
- Delete the clone. The code scanners' clone is removed when the scan ends. AI scanners keep a working checkpoint so a run can resume.
- Report, and watch for gaps. Findings land in your list. Commits that have not changed are skipped next time, and a repository that goes 7 days without a scan sets off an alert.
How your organisation is kept separate
Each organisation has its own subdomain and portal database, and its findings in the shared store are namespaced to it. Stored tokens are encrypted with AES-256-GCM, and the AI never receives your clone credential.
Where AI comes in
On Free, no AI runs: only the code scanners. On Team, AI verdicts, Agentic SAST and fixes send only what each task needs to the model, through one gateway.