Every part of Security belongs to one of three roles. The Overview, the Operations tab, the Factory and Settings → Activity all show work by these roles.
- Red team: attacks isolated copies of your code. It looks for ways in, the way an attacker would, and tries to prove them.
- Independent check: decides what counts. A claim becomes a finding only when a second agent works it out again, or when its proof reproduces twice.
- Blue team: protects the code itself. It watches for known problems, guards every change, fixes what it can and checks that fixes hold.
The red team
| Station | What it does |
|---|---|
| Map | Reads the code for every way into it: HTTP routes, webhooks, queue consumers and command-line commands. It drafts the threat model and fills the Attack surface tab. Mapping uses no AI model and is always on. |
| Hunt | The security audit reads your most important code like an attacker, starting with the entry points the internet can reach. It uses a model, so it spends credits, and it is off until you switch it on. |
| Prove | Tries each claim in an isolated copy of your code, with a test that fails while the vulnerability is there. |
The independent check
| Station | What it does |
|---|---|
| Re-derive | A second agent works each claim out again from the code. The security issues Coroid Review raises on pull requests go through it too. |
| Rerun | A proof counts only when it reproduces twice, in two fresh environments. |
Until a claim passes, it is listed as "Not confirmed yet": it has no due date, blocks nothing and notifies no one. See Evidence.
The blue team
| Station | What it does |
|---|---|
| Watch | Vulnerable dependencies, leaked secrets, code and GitHub's own alerts, on the default branch. |
| Guard | Scans every pull request and every agent change before it merges, including new entry points without a sign-in check (see Attack surface). Also the sandbox network agents work behind. |
| Fix | Opens fix pull requests for vulnerable dependencies and confirmed code findings. |
| Verify | Rescans deployed and fixed revisions, so a finding closes only when the fix is really there. |
The loop
A proof that reproduced is kept as a regression check. It runs again against new candidates, and an owner or admin can run a project's kept proofs again against the default branch's head (Run the proofs again). If the hole reopens, the finding reopens too.
The Operations tab
Security → Operations shows how the teams worked together this week:
- The map: each team's stations with their runs this week, and the independent check between the red team and the blue team. Choose a station to see its runs.
- The run log: every run, the newest first, with its project, team, duration and result. Routine runs are told apart from runs someone started. Filter it by team or by day.
- The loop: how many proofs are kept as regression checks, and when they were last run again.
The Overview's Now line says what each team is doing at this moment. Each project's lane says whether a team is scanning it or waits, and why.
Scan now
Owners and admins can start work on request from each project's lane on the Overview, or Scan all projects now for every project:
- Full scan (blue team): dependencies, leaked secrets and code at the default branch's head;
- Dependencies only (blue team), which also refreshes the advisory data it matches against;
- Leaked secrets in history (blue team): walks the whole history again;
- Map the attack surface (red team);
- Security audit (red team), where it is switched on: the menu says what it may spend before it starts;
- Run the proofs again (red team), where the project has kept proofs: each replay shows as the independent check's Rerun.
A scan someone starts runs like any other: it takes one of your agent slots, and waits, shown as waiting, when none is free or your plan's agent hours are spent.
What it costs
Work without an AI model (watching, guarding, verifying, mapping and proofs) spends no credits. Its runner time counts as agent hours, like any other work, and it waits when your plan's hours are spent. The audit, the independent check's second agent and fix tasks also spend credits. See What it costs.