Review source revisions
A change review compares two revisions of a project's source and lists the security issues in what changed. It needs no GitHub or GitLab integration: you upload each version of the source, and AISafe reviews the difference. It uses the same price and included monthly reviews as a PR review.
Open PR reviews → Change reviews in the project. A project whose source is uploaded archives opens there directly.
Upload a revision
Choose Upload revision on Change reviews, or on the project's Setup →
Source page. Upload the whole codebase as a .zip archive or a folder. Both
places use the same upload as the new-project form: a single top-level folder
is removed and the files AISafe skips by default are left out, so the same code
always becomes the same revision.
After an upload, AISafe offers to review it against the revision before it. A project with no source yet gets an Upload source button.
Start a review
Choose Review changes, or Review changes beside a revision in Setup's source history. Pick the base (the earlier revision) and the head (the changed one). Revisions are listed by number, file name, date and who added them. The base follows the head's previous revision until you pick another one. When the head was uploaded on top of the base, the form shows how many files and lines changed.
A title and notes for the reviewer are optional. The notes tell the reviewer what the change is for. The form says what the review costs: one included review, or the PR review rate once those are used up. Starting a review requires manager-level project access and a plan that includes PR reviews.
Repository projects fetch a branch, tag or commit for either side instead of uploading.
While it runs
The review page shows each step and the time elapsed. You can leave the page; the review keeps running. A review that stops before it finishes is not charged, and any included review it used is given back.
Read the result
The summary lists the issues by severity, the files reviewed, the lines changed, how long the review took and what it cost.
Issues lists what the review found. Issues are not added to the project's findings automatically. Open an issue to read it and mark it triaged, or select several and choose Confirm; a triaged issue joins the project's findings. You can also mark an issue as a false positive or an accepted risk.
Changes shows what the review covered and the diff, in unified or split view, with each issue next to the lines it is about. On a phone the diff is always unified, because split view is too narrow to read there. Copy a link to a file, an issue as Markdown, or a suggested fix.
A pair of revisions is reviewed once. Asking to review the same pair again opens the existing review instead. If a review failed, Retry review starts a new one; it uses another included review or the standard price.
A revision whose source has been removed cannot start a new review. Issues already recorded stay in the project, while a diff disappears with the source it quotes.