A repository report points a security agent at your codebase. The agent clones the repo into an isolated sandbox, chains findings together the way an attacker builds a kill chain, and reports exploit paths with repro steps. Because it runs with the full repo as context, this is the gray-box option: it sees your code, not just your public surface.

Create a repository report

1. Open Red team and select New report, or go to /app/reports/new.
2. Choose Repository.
3. Select one or more repositories from the repos where Superagent Security is installed.
4. Optionally add a goal prompt to focus the engagement, then submit.

Private repositories require the security app with repository contents access. Beyond manual creation, repository reports can trigger automatically on a GitHub release, a tag, or a schedule.

The report detail page

Repository reports open at /app/reports/repository/[id]. The detail view includes:

• Run status and the live agent event feed
• Linked findings discovered during the run, each with repro context
• Assignees and status updates for your team's review workflow
• Cost and timing for the engagement

Findings

Discovered issues land in the Findings queue as repository_red_team findings. From there you can run automated triage to verify exploitability and turn confirmed issues into fix PRs.

Relationship to PR scans

Repository reports use the same GitHub App installation as PR Scans. PR scans check every pull request before merge; reports are deeper, long-running engagements you start on demand or on a trigger.

Next steps

• Running reports
• Findings
• Repositories