> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Run a Code Audit > Audit a connected repository branch, review source findings, and schedule reassessment after code changes. Code Audit reads one commit of a connected repository branch: scanners flag suspect code, a security review investigates what they flag, and verification decides what holds up. It keeps those source findings separate from [Pentest apps and findings](https://docs.cloudthinker.io/guide/security/pentest.md). ## Prerequisites * The workspace **Admin** or **Developer** role. Viewers can read audits and findings but can't start one. See [Roles](https://docs.cloudthinker.io/guide/security/roles.md). * A [connected Git provider](https://docs.cloudthinker.io/guide/connections/overview.md) with access to the repository and branch you want to assess. * Permission to audit that source. You don't need a pentest app, an application URL, DNS proof, or an application login. > [!NOTE] > > Code Audit can be turned off separately from Pentest. If **Repositories** is missing from the Cyber sidebar, ask CloudThinker support, or whoever runs CloudThinker for your company. ## Start an audit **1. Choose the source** Open **Cyber**, click **Repositories** in the sidebar, then click **Audit repository**. On **Choose source**, pick the repository and the branch you want assessed. The sidebar's **New code audit** link opens the same form. You can also click **Run Code Audit** on a repository in Review settings. Check the preselected repository and branch before you continue. **2. Review and launch** Click **Review audit**. Confirm the source and the two checks, then click **Start Code Audit**. **Success state:** the audit report opens and tracks three stages: **SAST**, **Security review**, and **Verification**. The audit pins the branch's latest commit when it starts, so a push during the run doesn't change what it assessed. ## Read the results **SAST** is the automated pass: scanners read the code and flag suspect lines and exposed secrets. **Security review** looks at how the code behaves and raises candidates. **Verification** weighs each candidate against its evidence and decides the outcome below. | Finding outcome | Meaning | | - | - | | **Needs review** | Assessment is pending, blocked, or inconclusive; review the limitations | | **Confirmed** | Verification supports a security problem in the assessed source | | **Not confirmed** | Verification did not support the candidate | | **No longer detected** | A later audit covered that code and no longer flags it. This is not proof that a fix was tested | Open a finding to read its impact, the fix, the conditions it depends on, the verification, and the lines it points at. That evidence belongs to the commit the audit pinned. Proving a problem in source code doesn't prove it can be exploited against the running app: that's what a [pentest](https://docs.cloudthinker.io/guide/security/pentest.md) is for. A finished audit doesn't mean every file was read. Failed checks, skipped files, and blocked verification all need a look. A failed audit can still show what it collected, but those results are incomplete. ## Track a branch A tracked branch keeps the published findings from completed audits and links to the earlier ones. Later audits update the branch view without rewriting reports you already have. * **Run audit** in the branch header assesses the branch again. An unchanged commit is skipped until a full scan is due. * A full scan reads the whole tree instead of the changed files only. You don't ask for one: it happens when there's no successful audit to compare against, when commit history is missing, when the analysis settings change, or seven days after the last full scan. * A failed or cancelled attempt leaves the last published findings in place. Check the current attempt's status before you read the branch view. ## Choose a findings view Switch between **Table** and **Kanban**. Search, severity, source, and false-positive visibility carry across views and detail navigation. The board groups findings by outcome, and you can't drag a card to change its verdict. **Not confirmed** findings are hidden by default; use **Show false positives** to read them. On a tracked branch, **No longer detected** still isn't the same as a confirmed fix. Pentest's triage stages don't apply here. New, unchanged, and reappeared describe what changed between audits, not extra verification outcomes. ## Schedule reassessment Click **Schedule** in the branch header, or in the branch's **Settings**, to open **Schedule branch checks**. Pick a recurrence and check the timezone it shows, or tick **Audit when commits are pushed to this branch**. Push auditing follows the exact connected repository branch. Once a schedule is saved, **Schedule** opens it as an [Automation](https://docs.cloudthinker.io/guide/automation/automations.md), where you edit, pause, or delete it. A queued or running audit is not a finished result. When an audit ends, its notification links to the report. ## Hand off confirmed findings Click **Create PR with agent** on a confirmed finding to open a fix conversation. The conversation works from the current branch and keeps the assessed commit for comparison. **Open conversation** on an audit reopens the conversation that audit saved. There's no button that files a tracker ticket from a Code Audit finding, so raise that in your tracker yourself. Preparing or merging a fix doesn't change the original verdict. Run another audit against the changed code, or wait for the branch's next scheduled audit. ## Troubleshooting For every Cyber problem in one place, see [Cyber troubleshooting](https://docs.cloudthinker.io/guide/security/cyber-troubleshooting.md). > **The repository or branch is missing** > > Check the repository's access in Connections. Review setup and Code Audit access are separate, so connecting a repository for Review doesn't open a different one to Code Audit. > **The audit failed but old findings are still visible** > > The branch keeps the findings from its last completed audit. Open the failed attempt to read its error, fix the cause, then click **Run audit** again. > **A finding still needs review** > > Read its evidence and the audit's limitations. Blocked or inconclusive verification isn't a clean result, even when the audit finished. > **A merged fix hasn't changed the outcome** > > A saved audit always describes the commit it pinned. Click **Run audit** on the branch, or wait for its next scheduled audit. ## Next steps > **[Monitor library vulnerabilities](https://docs.cloudthinker.io/guide/security/cyber-libraries.md)** > > Read dependency advisories and application impact separately > **[Run a pentest](https://docs.cloudthinker.io/guide/security/pentest.md)** > > Test the running application's behavior and collect runtime proof > **[Connections](https://docs.cloudthinker.io/guide/connections/overview.md)** > > Manage the repository and tracker access Cyber uses This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.