# How scans work

> Recon, PR reviews, deep scans, Quick Scan and fix checks, and what each one does with your code.

RedNest runs several kinds of scan. All of them read your code in a temporary workspace that is deleted when the scan ends. None of them run your application, its tests or the proofs of concept they write.

| Scan | Runs when | What it does | Allowance |
| --- | --- | --- | --- |
| Recon | A repository is ready after App install / sponsorship | Builds the repository's threat model | Not charged as a holder/free scan allowance |
| PR review | A pull request is opened or updated | Reviews the change for vulnerabilities | One chargeable scan allowance |
| Deep scan / Dig | You press **Deep scan**, or an agent starts one | Hunts across the whole repository | One chargeable scan allowance |
| Quick Scan | You paste a public GitHub URL | Deep scan without App install | One chargeable scan allowance |
| Fix check | You push to the default branch | Re-checks open findings whose cited files the push changed | Not charged as a holder/free scan allowance |

Chargeable scans use your lifetime free scan first, then (after $RED holder activation) monthly holder allowances. See [Pricing & $RED access](https://rednest.tech/docs/pricing). Accounting reserves an allowance when the scan is authorized and settles it when the scan meaningfully starts; failed or refused starts do not permanently consume that allowance in the usual path.

An account runs at most two scans at a time, and recon has two slots of its own. Repositories of a million lines of code or more aren't scanned.

## Recon

Recon maps the repository the way an attacker would before trying anything: entry points, trust boundaries, sensitive data, dangerous code and existing protections. The result is the repository's **threat model**. Every later scan of that repository starts from it.

On organizations, recon and automatic reviews typically need an accepted [scan sponsor](https://rednest.tech/docs/github-app#organization-sponsorship).

## PR reviews

A pull request is reviewed when it is opened, gets new commits, is reopened, or is marked ready for review. Some aren't reviewed automatically:

- drafts, until they are marked ready for review
- pull requests from forks of public repositories, and from outside contributors' forks of private ones (see [below](#pull-requests-from-forks))
- pull requests when no scan allowance is available: these get a neutral Check instead

1. RedNest posts a **RedNest** Check straight away, showing "Scanning…".
2. It reviews the change in the context of the threat model. A finding has to touch the lines the pull request changed: issues that were already there are left for deep scans.
3. It completes the Check, and on private repositories posts the findings as review comments.

Each commit is reviewed once. One chargeable scan allowance covers the review.

### The Check

| Result | When |
| --- | --- |
| Failure | A finding is at or above your threshold (High, unless you change it) |
| Success | Nothing at or above the threshold |
| Neutral | Not reviewed: no allowance, or the review couldn't finish |

Set the threshold in [Settings](https://rednest.tech/dashboard/settings): Critical, High, Medium or Any. Low-confidence findings never fail a Check. A Check only blocks merging if you make it a required status check in GitHub's branch protection. A neutral Check never blocks.

### Private repositories

Each finding is posted as a review comment on the last step of its attack path that is inside the diff.

### Public repositories

On public repositories, RedNest posts no review comments and no details: only the Check, with counts by severity and a link to the dashboard.

### Pull requests from forks

- On **public** repositories, pull requests from forks are never reviewed automatically. A maintainer with write access comments `/sandchest review` on the pull request to start one.
- On **private** repositories, pull requests from forks are reviewed automatically when the author is an owner, member or collaborator. For anyone else, a maintainer comments `/sandchest review`.

The command has to be on a line of its own. Comments from people without write access, and from bots, are ignored. (The slash command text still uses the upstream `sandchest` token in the product today.)

RedNest never opens GitHub issues.

## Deep scans and Dig

A deep scan hunts across the whole repository. It runs when someone presses **Deep scan** on the repository's page, **Scan again** on a finished deep scan, or when an agent starts one. Anyone who can push to the repository can start one (subject to allowance).

- One deep scan runs at a time per repository.
- The scan's page shows a live feed, and findings appear as they survive verification.

## Quick Scan

Public repository URLs can be scanned from [Scans](https://rednest.tech/dashboard/scans) without installing the App. See [Quick Scan](https://rednest.tech/docs/quick-scan).

## Fix checks

When you push to the default branch, RedNest checks open findings whose cited files that push changed. If the attack path is gone, the finding is marked **fixed**. Fix checks are not charged as free or holder scan allowances.

## How RedNest finds vulnerabilities

PR reviews and deep scans run the same pipeline:

1. **Signal sweep.** A fast pass finds leaked secrets, vulnerable dependencies your code calls, and dangerous code reachable from an entry point. These are leads, not findings.
2. **Hunt.** Several attacker agents work in parallel from the threat model and the leads.
3. **Evidence gate.** A candidate is kept only if it names the entry point, cites every step by file and line, states who can exploit it, and includes a proof of concept.
4. **Skeptic.** Another pass tries to disprove the finding from the code before it is reported.