ContextCode ReviewWhiteboxIntegrationsMCP
A new Context page for your repositories, applications, and threat models
Context page: A dedicated Context page now gathers what Hacktron knows about your code, split across Repositories and Applications tabs. Cards are sorted by most recent threat-model update and show a badge for each model’s status; clicking one opens its threat model.Applications: Group related repositories into an application, and Hacktron synthesizes an application-level threat model by merging the threat models of its member repos. You can scan an application as a single target so findings are grounded in the combined model, and any context documents you upload to the application are folded into it.Threat models: Repository and application threat models now open in an inline reading view with a file tree and outline, and you can edit them with your changes preserved across regenerations.Redacted findings on public PRs: For public repositories, the PR review comment no longer includes full titles, descriptions, proof-of-concept code, or file locations for findings outside the changed lines. You see a count and a link back to Hacktron, so sensitive details stay out of the public thread. Private and internal repos are unchanged, and inline comments on the diff itself are unaffected.Org-level fail-on severity default: Organization admins can now set a default severity threshold for PR/MR checks in settings. Individual repo configs still take precedence when set.Enterprise SSO sign-in: A dedicated single sign-on page and a “Single sign-on (SSO)” button on the login screen let users authenticate via your organization’s SAML or OIDC identity provider. Invite tokens survive the IdP round-trip, so onboarding links still work.Duplicate marking in the MCP tool: Theupdate_finding MCP tool now accepts a duplicate_of field so you can mark or unmark duplicates programmatically.Explore the Context page → · Group repositories into an application → · Learn how threat models work → · Set a fail-on severity threshold → · Read the API reference →Code ReviewWhiteboxBilling
Dismiss a finding and your PR check clears instantly
PR and MR checks update on triage: When you mark a finding as a false positive or accepted risk, the GitHub check or GitLab commit status flips back to passing right away, with no manual re-run needed. If you later reopen the finding, the check fails again to match.Close findings as duplicates: You can now mark a finding as a duplicate of another finding in the same repository, and unmark it if needed. A duplicated finding inherits its canonical finding’s severity when the PR gate counts blocking issues.Scan volume chart: The dashboard’s scan volume widget now shows a stacked bar chart instead of a line graph, with a tooltip on each bar showing the Code Review and Whitebox scan counts for that day.Upload scans named after the archive: When you start a Whitebox scan from an uploaded archive, the scan now takes the archive’s filename as its name instead of a generic label.Legal agreement before trial or billing: You now review and accept the terms of service before starting a free trial or adding a payment method.Set up GitHub or GitLab →Code ReviewBillingMCP
Control your scans and account security like never before
Multi-factor authentication controls: Secure your account with MFA requirements and additional verification steps. Admins can enforce MFA across their organization.API access through MCP protocol: Connect external tools and scripts to Hacktron’s finding-triage toolset through a new remote MCP server endpoint with OAuth and API key authentication.Exclude scans with repository configuration: Use.hacktron/config.yaml to exclude pull request scans based on file patterns, keywords in titles, or labels.Secure your account with MFA → · See MCP integration → · Configure repository scanning →IntegrationsCode Review
GitLab now works just like GitHub
Automatic merge-request scanning: Connect a GitLab project and merge-request scans turn on by themselves, exactly as they do for GitHub. Turn them off per project whenever you want.GitLab in signup and trials: Connect GitLab during signup or a trial and it follows the same guided setup as GitHub, start to finish.Set up GitLab →Code ReviewBillingIntegrations
Go from a Slack alert to a fix in one click
Fix with AI in Slack: Finding alerts in Slack now carry a “Fix with AI” button that deep-links the issue straight into Cursor or Claude. See the alert, open your editor, fix it.No-card free trials: Start a free trial without a credit card. You enter payment details only when you decide to subscribe.Findings close themselves on abandoned PRs: Close a pull or merge request without merging and its findings move to a new “Closed” state. Reopen the PR and they come back, and anything you already triaged stays put.Up-front unsupported-language notices: Cost estimation now tells you when a repository is mostly in a language Hacktron cannot scan yet, instead of failing with no explanation.Clearer GitLab connection setup: The Connect GitLab dialog walks you through GitLab’s group Service Accounts step by step and adds a GitLab.com / Self-hosted toggle that matches the GitHub Enterprise setup.Connect Slack → · Start a free trial →Self-HostingIntegrationsCode ReviewWhitebox
Scan self-hosted GitHub Enterprise Server
GitHub Enterprise Server: Point Hacktron at self-hosted GitHub Enterprise Server for white-box scans and PR reviews, and run several Enterprise hosts next to github.com at the same time.GitLab MR feedback matches GitHub: Merge-request comments now carry severity badges, collapsible proof-of-concept, trace diagrams, and a “Fix with AI” block. Trigger a review with@hacktronai review, and triage shows up the
same across the web app, Slack, and the MR thread.Scan an exact tag or commit: Target a specific tag or commit when you pick
a repository for a Whitebox scan, not just a branch.Richer Jira ticketing: Search large Jira projects and assignee lists while
filing a ticket, and issues you create from a finding link back to it.Set up GitHub Enterprise Server → · See how reviews work → · Set up Jira →Code Review
PR comments that fix the bug for you
Sharper GitHub PR comments: Pull-request comments now use crisp severity badges instead of emoji, with a “Fix with AI” prompt that reproduces the issue, fixes the root cause, and adds a regression test.See how PR reviews work →BillingCode ReviewIntegrations
Share Code Review limits across your whole org
Org-pooled limits, annual seats, and a Usage page: Code Review limits are now pooled across your whole organization instead of capped per seat, you can buy developer seats on an annual prepaid plan, and a new owner-only Usage page shows usage and any overage for the period.Redesigned sidebar navigation: Cleaner, collapsible sections that remember what you left open, with account actions moved into the sidebar header.On-demand PR reviews: Comment@hacktron review on a pull request to
review it on the spot, even on drafts or external-contributor PRs.Request GitHub access without being an admin: If you do not own the GitHub
organization, clicking Connect sends an installation request to your admin and
marks it pending. The integration appears the moment they approve.Smoother Jira setup: A cleaner Jira configuration and per-ticket dialog,
with sensible defaults already on for new installs.Slack Connect onboarding: Sign up with a work email and set up
notifications right away through a Slack Connect step.See billing and plans → · Set up Code Review →WhiteboxCode Review
Findings open straight into the taint trace
Redesigned vulnerability views: The taint-trace and call-graph views are rebuilt, opening right into the trace with smooth collapse animations, and the full-page finding view now has the same actions as the sidebar.“Whitebox” everywhere: Scans we used to call “Pentest” are now “Whitebox”, with “Whitebox Scans” and “PR Reviews” split apart so it is obvious which is a full code scan and which is a pull-request review.Finding history: Every finding now shows a timeline of how it changed from one scan to the next.Explore Whitebox scans →Code Review
No more repeated comments for the same bug
Cross-finding duplicate detection: Hacktron now spots when a new finding repeats one it already reported and links the two, so PR comments point back to the original instead of saying the same thing twice.DashboardCode ReviewIntegrations
A rebuilt dashboard, split by the work you do
New dashboard: Separate Overview, PR Review, and Whitebox Scan tabs, so each kind of work shows the metrics that actually matter for it.Taint-trace timeline and call graph: Vulnerabilities now show a step-by-step taint-trace timeline and an interactive call graph, with source, propagation, and sink marked, so you can follow exactly how an issue moves through your code.Richer Linear integration: Pick a default Linear project, back-fill tickets for existing findings, map finding severity to Linear priority, and mirror Linear status changes back onto the linked finding.Set up Linear →Billing
Keep reviewing past your limit instead of getting blocked
Owner-controlled spillover billing: Organization owners can switch on spillover billing so PR reviews keep running past your included limit, billed as overage instead of stopping cold.See usage and spillover billing →Whitebox
Share a live view of any scan
Public scan activity page: Shared scans now have a public activity page with the scan’s events, timeline, and the agents that worked on it.BillingIntegrations
50 PR reviews a seat, then $1 each instead of a wall
PR review limits with overage: Every developer seat now includes 50 PR reviews per billing period, and any extra reviews bill at $1 each so they keep running instead of stopping.Resubscribe in one click: Canceled organizations now get a Resubscribe button to pick their old plan back up.Custom trial duration: Trials can run for a length you choose, with a clear prompt when you reach their limits.Slack invite flow: Invite teammates to your Hacktron organization straight from Slack.See usage and spillover billing → · Invite your team on Slack →Code Review
Stop a scan mid-run
Cancel a running scan: Stop a scan that is already in progress right from the scan view, no waiting for it to finish.Guided setup checklist: A getting-started checklist walks you through connecting your repositories and turning on Code Review, so new teams reach their first scan faster.Set up Code Review →Code Review
A home for your Code Review findings
Code Review page: A dedicated page with scan-scoped findings, and PR comments that link straight back to the finding in Hacktron.Syntax-highlighted code: Affected code in the finding view is now syntax-highlighted, so vulnerable snippets are far easier to read.Explore Code Review →APIIntegrationsBilling
Drive Hacktron from your own scripts
Public REST API: Reach your scans, findings, and repositories programmatically with API keys, backed by interactive API docs.Slack link unfurling: Finding and scan links now unfurl in Slack with live status, severity, and triage, so your team stays in sync without leaving the channel.Linear tickets from findings: Create a Linear issue straight from a finding, with the details filled in for you.Cancel and reactivate yourself: Cancel or reactivate your subscription right from the billing page, no support ticket needed.Redesigned billing page: A rebuilt billing experience with clearer plans, credits, and subscription status.Read the API reference → · Connect Slack → · Set up Linear → · Manage your subscription →WhiteboxCode Review
See how a vulnerability moves through your code
Visual trace diagrams: Vulnerabilities now include a visual diagram, in both the finding view and the PDF report, so you can trace how an issue moves through your code at a glance.More flexible pentests: Start a pentest from a public repository URL or an uploaded archive, with the source shown in the cost estimate before you commit.Context documents: Upload notes about a repository so reviews understand your codebase and its conventions.Markdown in findings: Finding descriptions, dismiss reasons, and comments now render full Markdown, with one-click copy of the report.Start a Whitebox scan →Code Review
Triage findings without leaving the browser
Triage from the web: Dismiss findings with a reason and leave feedback in an activity thread, right in the app.Read the triage guide →WhiteboxBilling
Watch findings arrive as a scan runs
Live scan progress: Scans now stream their progress in real time, so you watch findings show up as they are discovered instead of waiting for the end.Cost estimation before you scan: See an estimated cost before you start a scan or pentest.Downloadable reports: Generate a PDF report of your findings straight from the browser.BillingWhitebox
Pay for pentests with credits
Pentest credits: Buy pentest credits and spend them on pentests when you are ready.Public scan disclosure: Share a scan and its findings through public, read-only pages.See pentest credits →Billing