Code AuditBeta

Inth Code Audit finds code-evidenced privacy and data-protection risks in a repository. It combines deterministic code signals with investigation of the surrounding data flow, then produces findings that engineering, privacy, security, and legal teams can review.

Code Audit can identify areas such as:

• personal or sensitive data written to logs and observability tools
• analytics, advertising, replay, or identity tools loaded before consent
• retention, deletion, DSAR, and data-export gaps
• personal data sent to vendors, webhooks, CRMs, or AI services
• privacy-relevant changes introduced by a pull request

Code Audit does not make final legal conclusions. Its findings are evidence for review.

Before you start

You need:

• an Inth organization and project
• an organization owner or admin who can connect the Inth GitHub App
• access to the repository you want to audit
• enough Inth Credits for the audit you want to run

Adding the project's production website and public policy pages is recommended. This gives Code Audit context about your disclosures and intended privacy controls, but it does not block a scan.

Connect a repository

1. In the Inth dashboard, open Audit.
2. Open the project that owns the code.
3. Under Code, select Connect GitHub.
4. Complete the GitHub App installation and choose the repositories Inth may access.
5. Return to the project and link a repository.
6. Set the Root directory. Use / for the whole repository or a subdirectory for one app in a monorepo.
7. Set the production branch if it is not the repository default.

GitHub shows the permissions requested by the App before installation. Repository access can be managed later from the project's Code settings.

Add policy context

Policy context helps Code Audit compare code evidence with the controls and disclosures intended for the product.

From the project's Audit page:

1. Add the production website.
2. Add public pages such as your privacy policy, cookie policy, terms, or subprocessor list.
3. Save the website and policy pages.

Keep these URLs current. Inth reads policy context from the active website connected to the project.

Run a full repository audit

1. Open Audit and select Run audit.
2. Choose the connected repository.
3. Confirm that it is linked to the correct project and root directory.
4. Select Get quote.
5. When planning finishes, review the Credit quote and planned file count.
6. Select Start full audit.

Planning is free. The full audit starts only after you approve the quote. Inth prevents another full audit from starting for the same repository while one is already active.

Use Audit → History to monitor queued, running, investigating, and completed audits or to return to a quote that is ready for approval.

Time and Credit expectations

Full Code Audits are one of the more Credit-intensive operations in Inth. Repository size, the selected scope, and the amount of privacy-relevant code all affect the work required.

Large or complex repositories can take more than an hour to complete. Use a project root directory to avoid auditing unrelated apps in a monorepo, and check the quote before starting the full run.

The dashboard shows a Credit quote for the planned scope before you approve the full audit.

Configure pull request scans

To review changes before merge:

1. Open Integrations and select the connected repository, or open the repository settings from the Run audit sheet.
2. Enable Scan pull requests.
3. Optionally add PR branch filters such as main or release/*, one per line.
4. Optionally add ignored PR paths such as docs/**, one path or glob per line.

Branch and path filters support wildcards, including ** for nested directories. Leave the branch field empty to scan pull requests for every branch.

Pull request automation is managed by the first Inth organization that connected the repository. Other linked organizations can still run manual audits. Scheduled full-repository Code Audits are not currently available.

Each pull request scan reviews the files GitHub currently includes in the PR diff after project-root and ignored-path filtering. It does not rescan the whole repository, but it does review the full current PR diff rather than only files from the latest push. Ordinary duplicate webhook deliveries reuse the current run. A newer head supersedes older work, and only the current head can publish its check and review.

Deduplication is scoped to one pull request. If changes from a reviewed branch later appear in a stacked or long-lived integration PR, they can be reviewed again while GitHub still includes them in that PR's diff.

Pull request scan Credits

One Inth Credit is $0.10. A successfully settled pull request scan costs a 50-Credit ($5) platform fee plus the reconciled AI provider cost priced at a 30% gross margin, rounded up to a whole Credit. The final amount is known after the provider reports the run's usage.

Inth keeps the completed report private until the full Credit amount settles. If the organization has enough Credits for the platform fee but not the final provider-cost balance, the platform fee is charged and the report remains locked until an owner adds Credits. Inth automatically retries settlement and publishes the existing scan after the top-up; the audit does not run again. Failed, cancelled, and superseded scans do not settle the full successful-scan price.

Review the report

A completed report identifies the repository, branch, commit, and scanned directory. Findings can include:

• priority and review state
• affected files and source lines
• supporting source evidence
• the relevant data flow or control area
• remediation or review guidance

Start with critical and high-priority items, but treat priority as potential impact rather than proof of a legal violation. Review the cited code in context, confirm assumptions with the code owner, and record whether the finding is confirmed, fixed, not evidenced, or accepted as a risk.

If investigation coverage is incomplete, the report says so. Retry the audit before treating missing findings as evidence that the repository is clear.

Coverage and limitations

JavaScript and TypeScript have the broadest validated analysis coverage. Go, Python, Astro, Vue, and Svelte coverage is currently preview-stage, and some privacy-relevant behavior may require manual review.

Code Audit can miss behavior hidden behind runtime configuration, external systems, generated code, or unsupported languages. A clean report is not a compliance certificate or a guarantee that every privacy risk has been found.