BillingIntegrationsWhiteboxSelf-Hosting
Separate credit accounts and more on-premises scan options
Automation and Whitebox credits: Billing now shows separate accounts for Automation credits and Whitebox Scan Credits. Each account has its own balance, current-period usage, purchase flow, and history. Auto top-up is available for Automation credits only.Microsoft account connection: Members can connect the Microsoft account they use for Azure DevOps from Personal settings. When its email matches the pull request author’s Azure DevOps UPN, Hacktron can attribute later pull request activity to the correct member and Code Review seat.More Whitebox sources on-premises: On-premises deployments can select enabled GitHub Enterprise Server repositories or upload.zip, .7z, .tar.gz, and .tgz source archives when starting a Whitebox Scan.Internal Git and air-gapped support: Appliance operators can allow specific private Git hosts, add trusted CA certificates, and collect masked support bundles without an outbound internet connection.Glob patterns for author filters: Repository and organization author filters accept *, **, ?, and {a,b} patterns as well as exact names. Pattern length, wildcard count, and brace alternatives have bounded limits.Clearer Automation feedback: Deleting an automation shows a confirmation with its name. Trying to enable an incomplete automation identifies the missing configuration.See billing and plans → · Connect your Microsoft account → · Configure on-premises deployments → · Configure scan filters →IntegrationsCode ReviewDashboardWhiteboxBilling
Azure DevOps is here, plus bulk triage and live AI runs
Azure DevOps PR scanning: Connect your Azure DevOps organization with a personal access token and Hacktron will review pull requests automatically, assign developer seats, and report findings - matching the GitHub and GitLab experience end to end.Bulk findings triage: Select any number of findings with checkboxes, then change their status or severity in one action. When a full page is selected, you can extend the action to every finding that matches your current filters across all pages.Per-run credit caps: Set a credit limit on each automation environment and a run that hits the cap stops cleanly instead of running unbounded. Once you raise the limit, you can restart the stopped run from where it left off.Live automation run transcript: Watch the AI agent’s reasoning, tool calls, and output appear in real time on the run detail page as a run executes, rather than seeing the result only after it finishes.Manual remediation runs in history: Every run started from the “Remediate” button on a finding now appears in the main runs list alongside scheduled automation runs, so you have one place to review all activity.Triage thread auto-resolution: Posting a triage command (!fp, !valid, !accepted_risk, !fixed) as a reply to a finding comment on a GitHub PR or GitLab MR now resolves that review thread automatically.Fix PRs loop in the original author: When an automation opens a fix PR into a developer’s feature branch rather than the default branch, it adds that branch’s author as a reviewer so the right person sees the fix.Finding category filter: Findings now show their OWASP category as a badge and you can filter the findings list by category to focus on a class of issues.Usage page by product: The usage page is reorganized into three tabs - PR Reviews, Automations, and Whitebox - each with its own credit and usage breakdown.Bot-authored PRs now reviewed: On GitHub, Hacktron reviews eligible bot PRs when the source branch belongs to the same repository. Bot PRs from forks and PRs from outside human contributors are not scanned automatically. Use author filters to exclude specific bot accounts.Glob patterns in author filters: Author include and exclude filters in.hacktron/config.yaml and organization scan settings accept *, **, ?, and {a,b} patterns as well as exact names.GitLab and Bitbucket reviews count against your pool: MR and PR reviews on GitLab and Bitbucket now draw from the same org-wide review pool as GitHub, with spillover billing and the per-file cap applied consistently across all three platforms.Cleaner Whitebox scan setup: Pasting a browser URL (including /tree/branch or /commit/sha suffixes) into the repository field during cost estimation now strips the suffix automatically. Private repos that cannot be accessed show an error immediately instead of proceeding silently.5,000 automation credits on first subscription: Organizations receive a one-time grant of 5,000 automation credits when they subscribe for the first time, applied at the point of payment.Connect Azure DevOps → · See automations → · Start a Whitebox scan → · Manage seats and usage →WhiteboxCode ReviewIntegrationsAPI
Walk a taint trace, export your findings, and scan Bitbucket PRs
Interactive taint trace reader: Taint findings now open an annotated code view where you can step through each source, propagation, and sink in sequence. Click any step in the sidebar to jump directly to that line in the file.Findings export: Download your findings as CSV, JSON, or SARIF directly from the findings page, filtered to exactly what is currently visible. The export respects all active filters - severity, status, scan, and repository.Findings export API: A new API endpoint (GET /rest/findings/export) lets you pull findings programmatically in CSV, JSON, or SARIF, with the same filter options available in the UI including scoping by repository.Bitbucket PR scanning: Connect a Bitbucket workspace and Hacktron will automatically scan pull requests, the same way it does for GitHub and GitLab.Model tier selection for scans: When starting a whitebox scan, you can now choose between the Default and Legacy model tiers before committing to a cost estimate.PR filter rules for authors and labels: Your .hacktron/config.yaml now supports skip.authors and include.authors to exclude or restrict scans by PR author, and include.labels to trigger scans only on labeled pull requests.GitHub file-level comments for line-agnostic findings: Findings with no specific line number now post as file-level comments on the GitHub pull request instead of being silently dropped.Mark Resolved from Slack: The finding Work Object overflow menu in Slack now includes a Mark Resolved action alongside the existing triage options.Read the API reference → · Set up GitLab → · Connect Slack →ContextCode ReviewWhiteboxIntegrationsMCP
A new Context page for your repositories, applications, and threat models
Context page: A dedicated Context page now gathers what Hacktron knows about your code, split across Repositories and Applications tabs. Cards are sorted by most recent threat-model update and show a badge for each model’s status; clicking one opens its threat model.Applications: Group related repositories into an application, and Hacktron synthesizes an application-level threat model by merging the threat models of its member repos. You can scan an application as a single target so findings are grounded in the combined model, and any context documents you upload to the application are folded into it.Threat models: Repository and application threat models now open in an inline reading view with a file tree and outline, and you can edit them with your changes preserved across regenerations.Redacted findings on public PRs: For public repositories, the PR review comment no longer includes full titles, descriptions, proof-of-concept code, or file locations for findings outside the changed lines. You see a count and a link back to Hacktron, so sensitive details stay out of the public thread. Private and internal repos are unchanged, and inline comments on the diff itself are unaffected.Org-level fail-on severity default: Organization admins can now set a default severity threshold for PR/MR checks in settings. Individual repo configs still take precedence when set.Enterprise SSO sign-in: A dedicated single sign-on page and a “Single sign-on (SSO)” button on the login screen let users authenticate via your organization’s SAML or OIDC identity provider. Invite tokens survive the IdP round-trip, so onboarding links still work.Duplicate marking in the MCP tool: Theupdate_finding MCP tool now accepts a duplicate_of field so you can mark or unmark duplicates programmatically.Explore the Context page → · Group repositories into an application → · Learn how threat models work → · Set a fail-on severity threshold → · Read the API reference →Code ReviewWhiteboxBilling
Dismiss a finding and your PR check clears instantly
PR and MR checks update on triage: When you mark a finding as a false positive or accepted risk, the GitHub check or GitLab commit status flips back to passing right away, with no manual re-run needed. If you later reopen the finding, the check fails again to match.Close findings as duplicates: You can now mark a finding as a duplicate of another finding in the same repository, and unmark it if needed. A duplicated finding inherits its canonical finding’s severity when the PR gate counts blocking issues.Scan volume chart: The dashboard’s scan volume widget now shows a stacked bar chart instead of a line graph, with a tooltip on each bar showing the Code Review and Whitebox scan counts for that day.Upload scans named after the archive: When you start a Whitebox scan from an uploaded archive, the scan now takes the archive’s filename as its name instead of a generic label.Legal agreement before trial or billing: You now review and accept the terms of service before starting a free trial or adding a payment method.Set up GitHub or GitLab →Code ReviewBillingMCP
Control your scans and account security like never before
Multi-factor authentication controls: Secure your account with MFA requirements and additional verification steps. Admins can enforce MFA across their organization.API access through MCP protocol: Connect external tools and scripts to Hacktron’s finding-triage toolset through a new remote MCP server endpoint with OAuth and API key authentication.Exclude scans with repository configuration: Use.hacktron/config.yaml to exclude pull request scans based on file patterns, keywords in titles, or labels.Secure your account with MFA → · See MCP integration → · Configure repository scanning →IntegrationsCode Review
GitLab now works just like GitHub
Automatic merge-request scanning: Connect a GitLab project and merge-request scans turn on by themselves, exactly as they do for GitHub. Turn them off per project whenever you want.GitLab in signup and trials: Connect GitLab during signup or a trial and it follows the same guided setup as GitHub, start to finish.Set up GitLab →Code ReviewBillingIntegrations
Go from a Slack alert to a fix in one click
Fix with AI in Slack: Finding alerts in Slack now carry a “Fix with AI” button that deep-links the issue straight into Cursor or Claude. See the alert, open your editor, fix it.No-card free trials: Start a free trial without a credit card. You enter payment details only when you decide to subscribe.Findings close themselves on abandoned PRs: Close a pull or merge request without merging and its findings move to a new “Closed” state. Reopen the PR and they come back, and anything you already triaged stays put.Up-front unsupported-language notices: Cost estimation now tells you when a repository is mostly in a language Hacktron cannot scan yet, instead of failing with no explanation.Clearer GitLab connection setup: The Connect GitLab dialog walks you through GitLab’s group Service Accounts step by step and adds a GitLab.com / Self-hosted toggle that matches the GitHub Enterprise setup.Connect Slack → · Start a free trial →Self-HostingIntegrationsCode ReviewWhitebox
Scan self-hosted GitHub Enterprise Server
GitHub Enterprise Server: Point Hacktron at self-hosted GitHub Enterprise Server for white-box scans and PR reviews, and run several Enterprise hosts next to github.com at the same time.GitLab MR feedback matches GitHub: Merge-request comments now carry severity badges, collapsible proof-of-concept, trace diagrams, and a “Fix with AI” block. Trigger a review with@hacktronai review, and triage shows up the
same across the web app, Slack, and the MR thread.Scan an exact tag or commit: Target a specific tag or commit when you pick
a repository for a Whitebox scan, not just a branch.Richer Jira ticketing: Search large Jira projects and assignee lists while
filing a ticket, and issues you create from a finding link back to it.Set up GitHub Enterprise Server → · See how reviews work → · Set up Jira →Code Review
PR comments that fix the bug for you
Sharper GitHub PR comments: Pull-request comments now use crisp severity badges instead of emoji, with a “Fix with AI” prompt that reproduces the issue, fixes the root cause, and adds a regression test.See how PR reviews work →BillingCode ReviewIntegrations
Share Code Review limits across your whole org
Org-pooled limits, annual seats, and a Usage page: Code Review limits are now pooled across your whole organization instead of capped per seat, you can buy developer seats on an annual prepaid plan, and a new owner-only Usage page shows usage and any overage for the period.Redesigned sidebar navigation: Cleaner, collapsible sections that remember what you left open, with account actions moved into the sidebar header.On-demand PR reviews: Comment@hacktron review on a pull request to
review it on the spot, even on drafts or external-contributor PRs.Request GitHub access without being an admin: If you do not own the GitHub
organization, clicking Connect sends an installation request to your admin and
marks it pending. The integration appears the moment they approve.Smoother Jira setup: A cleaner Jira configuration and per-ticket dialog,
with sensible defaults already on for new installs.Slack Connect onboarding: Sign up with a work email and set up
notifications right away through a Slack Connect step.See billing and plans → · Set up Code Review →WhiteboxCode Review
Findings open straight into the taint trace
Redesigned vulnerability views: The taint-trace and call-graph views are rebuilt, opening right into the trace with smooth collapse animations, and the full-page finding view now has the same actions as the sidebar.“Whitebox” everywhere: Scans we used to call “Pentest” are now “Whitebox”, with “Whitebox Scans” and “PR Reviews” split apart so it is obvious which is a full code scan and which is a pull-request review.Finding history: Every finding now shows a timeline of how it changed from one scan to the next.Explore Whitebox scans →Code Review
No more repeated comments for the same bug
Cross-finding duplicate detection: Hacktron now spots when a new finding repeats one it already reported and links the two, so PR comments point back to the original instead of saying the same thing twice.DashboardCode ReviewIntegrations
A rebuilt dashboard, split by the work you do
New dashboard: Separate Overview, PR Review, and Whitebox Scan tabs, so each kind of work shows the metrics that actually matter for it.Taint-trace timeline and call graph: Vulnerabilities now show a step-by-step taint-trace timeline and an interactive call graph, with source, propagation, and sink marked, so you can follow exactly how an issue moves through your code.Richer Linear integration: Pick a default Linear project, back-fill tickets for existing findings, map finding severity to Linear priority, and mirror Linear status changes back onto the linked finding.Set up Linear →Billing
Keep reviewing past your limit instead of getting blocked
Owner-controlled spillover billing: Organization owners can switch on spillover billing so PR reviews keep running past your included limit, billed as overage instead of stopping cold.See usage and spillover billing →Whitebox
Share a live view of any scan
Public scan activity page: Shared scans now have a public activity page with the scan’s events, timeline, and the agents that worked on it.BillingIntegrations
50 PR reviews a seat, then $1 each instead of a wall
PR review limits with overage: Every developer seat now includes 50 PR reviews per billing period, and any extra reviews bill at $1 each so they keep running instead of stopping.Resubscribe in one click: Canceled organizations now get a Resubscribe button to pick their old plan back up.Custom trial duration: Trials can run for a length you choose, with a clear prompt when you reach their limits.Slack invite flow: Invite teammates to your Hacktron organization straight from Slack.See usage and spillover billing → · Invite your team on Slack →Code Review
Stop a scan mid-run
Cancel a running scan: Stop a scan that is already in progress right from the scan view, no waiting for it to finish.Guided setup checklist: A getting-started checklist walks you through connecting your repositories and turning on Code Review, so new teams reach their first scan faster.Set up Code Review →Code Review
A home for your Code Review findings
Code Review page: A dedicated page with scan-scoped findings, and PR comments that link straight back to the finding in Hacktron.Syntax-highlighted code: Affected code in the finding view is now syntax-highlighted, so vulnerable snippets are far easier to read.Explore Code Review →APIIntegrationsBilling
Drive Hacktron from your own scripts
Public REST API: Reach your scans, findings, and repositories programmatically with API keys, backed by interactive API docs.Slack link unfurling: Finding and scan links now unfurl in Slack with live status, severity, and triage, so your team stays in sync without leaving the channel.Linear tickets from findings: Create a Linear issue straight from a finding, with the details filled in for you.Cancel and reactivate yourself: Cancel or reactivate your subscription right from the billing page, no support ticket needed.Redesigned billing page: A rebuilt billing experience with clearer plans, credits, and subscription status.Read the API reference → · Connect Slack → · Set up Linear → · Manage your subscription →WhiteboxCode Review
See how a vulnerability moves through your code
Visual trace diagrams: Vulnerabilities now include a visual diagram, in both the finding view and the PDF report, so you can trace how an issue moves through your code at a glance.More flexible pentests: Start a pentest from a public repository URL or an uploaded archive, with the source shown in the cost estimate before you commit.Context documents: Upload notes about a repository so reviews understand your codebase and its conventions.Markdown in findings: Finding descriptions, dismiss reasons, and comments now render full Markdown, with one-click copy of the report.Start a Whitebox scan →Code Review
Triage findings without leaving the browser
Triage from the web: Dismiss findings with a reason and leave feedback in an activity thread, right in the app.Read the triage guide →WhiteboxBilling
Watch findings arrive as a scan runs
Live scan progress: Scans now stream their progress in real time, so you watch findings show up as they are discovered instead of waiting for the end.Cost estimation before you scan: See an estimated cost before you start a scan or pentest.Downloadable reports: Generate a PDF report of your findings straight from the browser.BillingWhitebox
Pay for pentests with credits
Pentest credits: Buy pentest credits and spend them on pentests when you are ready.Public scan disclosure: Share a scan and its findings through public, read-only pages.See pentest credits →Billing