Docs

Getting started

Sign in with GitHub, GitLab or Bitbucket. Your first sign-in creates your account and a personal organization that holds your repositories, findings and credits.

Accounts are never merged by email. To use a second provider, sign in with the first one and link the second under Settings, Profile.

Connect your code

GitHub: install the swarmbase GitHub App and choose the repositories it may see. GitHub repositories always come through the App, so signing in with GitHub is not enough to import them.
GitLab and Bitbucket: the connection you signed in with lists your repositories. Turning on auto-scan later asks for one more permission (see Scanning).

Admins connect providers. Members and viewers work with the repositories admins have imported.

Import repositories

Pick repositories from the live list your provider returns, up to 50 at a time. Each one is checked against the provider, and its first scan starts as soon as it is ready.

A repository has to fit your plan's size limit to be scanned. The limits are on the pricing page.

Your first scan

Four scanners run side by side: code, dependencies, secrets and infrastructure. Findings appear as each one finishes, and a scanner that fails doesn't hold back the others.

From there:

Turn on auto-scan to scan every push and pull request.
Work through the findings, most severe first.
Send in the swarm for the attack paths rules can't see.