Public & private repositories
Once you've signed in, you connect a repository to Hyrax in one of two ways, and the way you connect it decides what Hyrax can do.
Two ways to connect
- Connect a GitHub organization (install the GitHub App). After signing in, connect your GitHub organization by installing the Hyrax GitHub App on the org or account whose repos you want covered, and choose which repos it can access. Repos connected this way can be private or public, and everything is available — including the workflows that write back to GitHub. See the Quickstart.
- Add a public repo by URL (also called anonymous mode). Point Hyrax at a public GitHub repository by its URL, no App install required. Handy for auditing an open-source dependency or trying Hyrax on a well-known codebase before you connect your own. These repos are cloned read-only, so write-back workflows aren't available.
Which workflows run in each mode
Read-only workflows run on any connected repo. Workflows that push a branch, open a pull request, or post to a PR need the App.
| Workflow | Public (by URL) | App installed |
|---|---|---|
| Full audit | ✅ | ✅ |
| Standard audit | ✅ | ✅ |
| Mini audit | ✅ | ✅ |
| Discovery | ✅ | ✅ |
| Revalidate | ✅ | ✅ |
| PR review | ✅* | ✅ |
| Fix | — | ✅ |
| Publish | — | ✅ |
* On a repo added by URL, you can run a review and read the results in Hyrax — but without the App installed there is no GitHub access to post the PR comment or check run, and no pull-request events to trigger reviews automatically. Install the App for the full PR-review experience.
To run Fix or Publish, install the App on the repo's org.
Plan limits
Your plan sets how many repos you can connect through the App: Free 1, Pro 3, Team unlimited. Adding public repos by URL is available on Team (ask us if you need it on a lower plan). See Plans & pricing.
Your results stay private
Results aren't shared across workspaces, even for the same public repository. If two workspaces both add owner/repo/branch, each gets its own independent audit history, observations, and discovery context. Your triage, dismissals, and history stay yours. See Security for how Hyrax handles your code and credentials.