Skip to main content

Running audits & fixes

Once your repos are connected, this is the loop you'll use day to day: run an audit, work through what it finds, ship fixes as pull requests, and keep findings current as your code changes. Everything here is in the web app.

Run an audit​

An audit reads your repository and produces findings plus a few architectural suggestions. Open a repository and click Run Audit from its page; you choose when to run it. The audit comes in three depths:

  • The Mini audit (Free) — a quick, lightweight pass that surfaces up to 5 findings.
  • The Standard audit (Pro and Team) — a focused 24-tool sweep across security, correctness, maintainability, performance, and dependencies.
  • The Full audit (Team) — the complete ~39-tool catalog, adding architecture analysis and the rest of operations on top of the standard set.

Run Audit runs the Mini audit on Free and the Standard audit on Pro and Team. On Team, a separate Full audit button runs the complete catalog when you want the deepest sweep explicitly.

Free is capped by volume

On Free you're limited to 1 Mini audit and 1 Discovery per calendar month. Pro and Team have no volume cap (you still consume credit per run). See Plans & pricing.

Watch it run​

Every job lands on the Activity page, which shows each run's status — Queued, Running, then Completed, Failed, or Cancelled. Open a job to follow its pipeline stage by stage; on Pro and Team you'll also see its cost tick up live and settle when it finishes. If an audit completes with some of its analysis groups failed, it's marked Partial Completion — the findings from the groups that succeeded are real and ready to triage. When your audit finishes, Hyrax also emails the person who started it.

Browse findings and suggestions​

An audit produces observations: findings (something to fix), suggestions (an architectural idea to consider), and the occasional advisory (broader process or CI guidance). Each has a stable ref (HYRAX-42), a priority (P0–P3, P0 most urgent), a category (Security, Correctness, Maintainability, Performance, Architecture, or Operations), and the file locations it touches. Filter and sort by priority, category, or kind to triage by impact. See Findings & suggestions.

Fix a finding​

Open an observation and click Fix. Hyrax makes the change, verifies it, and opens a pull request for you to review and merge. Spawning a fix does not close the observation — it closes as fixed only when the pull request is merged, and stays open while the fix is in flight. See Fixes.

Dismiss and triage​

Not every finding is worth acting on. Dismiss an observation with a reason: False positive, Won't fix, and Out of scope stay closed and won't re-surface; Stale, No longer found, and Other can reappear if the issue is found again. Re-running an audit merges with your existing observations rather than replacing them, so your triage is respected. You can reopen a closed observation at any time.

Revalidate to keep findings current​

Use revalidate to re-check existing observations against the latest commit and update their status without generating new findings — a fast, cheap correctness pass after you've shipped work. Re-running an audit also reconciles against what's already there: duplicates merge and dismissed items stay dismissed. Revalidate is available on Pro and Team.

A simple rhythm: run an audit on a regular cadence (weekly, or once per release) and after any major refactor, and use Revalidate between audits to confirm fixes landed.

Enable PR review​

Turn on review for a repo and Hyrax reviews incoming pull requests automatically — posting a single review comment (updated in place as the PR gets new commits) and a Hyrax Review check run you can gate merges on. PR review is available on Pro and Team. See Pull request review.

Spend controls​

  • Live cost visibility. On Pro and Team, the Activity page shows every job's cost, your remaining monthly credit sits in the top bar, and Settings → Plan shows the full picture.
  • Per-job budget cap. Each job has a budget ceiling; a job that would exceed it won't run, and a runaway job is stopped mid-run.
  • Overage spending limit. Set a hard dollar ceiling on overage spend for the period; once on-demand overage reaches it, Hyrax refuses new cost-bearing jobs until the next period. It can't exceed your workspace's overall spend cap.
  • Velocity limits. Per-plan limits on requests per minute and dollars per hour smooth out bursts.

How credit, included allowance, and opt-in overage work is covered in Plans & pricing.