Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

GitHub Code Scanning integration (SARIF)

Alongside the PR comment, audytx uploads a SARIF v2.1.0 document to GitHub's Code Scanning API at every scan. Findings land in the repo's Security tab with file:line annotations, severity grouping, framework-tag filter chips (aws-fsbp-s3.1, soc2-cc6.1), and stable per-finding fingerprints so the same alert tracks across PR pushes.

SARIF severity mapping:

Critical + High → error Medium → warning Low + Informational → note

Requirements. SARIF upload needs either a public repo or a private repo with GitHub Advanced Security. Private repos without GHAS still get the full PR comment; the Security-tab upload just no-ops.

Reasoning stays in the upload. When the engine reasons a finding away (see Context-aware reasoning), it still goes into the SARIF payload with a suppressions[] array carrying the justification. GitHub does not document acting on that field, so whether the Security tab shows such an alert as closed is up to GitHub. The PR comment lists them.