Public & private repositories
Once you've signed in, you connect a repository to Hyrax in one of two ways, and the way you connect it decides what Hyrax can do.
Two ways to connect
- Connect a GitHub organization (install the GitHub App). After signing in, connect your GitHub organization by installing the Hyrax GitHub App on the org or account whose repos you want covered, and choose which repos it can access. Repos connected this way can be private or public, and everything is available — including the workflows that write back to GitHub. See the Quickstart.
- Add a public repo by URL (also called anonymous mode). Point Hyrax at a public GitHub repository by its URL, no App install required. Handy for auditing an open-source dependency or trying Hyrax on a well-known codebase before you connect your own. These repos are cloned read-only, so write-back workflows aren't available.
Which workflows run in each mode
Read-only workflows run on any connected repo. Workflows that push a branch, open a pull request, or post to a PR need the App.
| Workflow | Public (by URL) | App installed |
|---|---|---|
| Full audit | ✅ | ✅ |
| Standard audit | ✅ | ✅ |
| Discovery | ✅ | ✅ |
| Revalidate | ✅ | ✅ |
| PR review | ✅* | ✅ |
| Fix | — | ✅ |
* On a repo added by URL, a review can be started for a specific pull request through the API, and its findings are readable in Hyrax — but without the App installed there is no GitHub access to post the PR comment or check run, no pull-request events to trigger reviews automatically, and no in-app trigger. Install the App for the full PR-review experience.
To run Fix, install the App on the repo's org.
Plan limits
Repositories are unlimited on both plans, and adding public repos by URL is available on both. What bounds your usage is your workspace's credit — each job draws against it — not a repository count. See Plans & pricing.
Your results stay private
Results aren't shared across workspaces, even for the same public repository. If two workspaces both add owner/repo/branch, each gets its own independent audit history, observations, and discovery context. Your triage, dismissals, and history stay yours. See Security for how Hyrax handles your code and credentials.