# Security scanner

> Turn on the pre-configured scanner that reviews each repository on a daily or weekly schedule, opens an issue per confirmed vulnerability, and opens a pull request with the fix.

devlo adds a **Security Scanner** to **Automations** when you connect GitHub. It’s off until you turn it on. On its schedule, weekly to start or daily if you change it, the scanner reads every repository in its scope at the default branch and looks for vulnerable dependencies, secrets in code and configuration, injection risks, authentication and authorization gaps, weak cryptography, risky configuration and CI, and data exposure.

## What it opens

* **One issue per confirmed finding**, titled `[Security] <Severity>: <what and where>` and labelled `security` plus a severity label, with the file and line, how an attacker reaches it, the impact, the evidence and references. It reports a secret’s location, never its value.
* **A pull request for each safe fix**, on a branch named `devlo/security/<slug>`, with the smallest change that closes the issue. Changes that need a decision, such as an authentication model change, a breaking dependency upgrade or a secret rotation, get a plan in the issue instead.

devlo never merges. Review the pull request as you would any other. A run opens at most a few issues and pull requests and remembers what it covered, so large repositories are scanned across several runs and nothing is reported twice.

## Turn it on

1. Open **Automations** and select **Security Scanner**.
2. Set **Scope**. It starts on **All repositories**; on Free, scheduled runs cover one repository.
3. Keep the weekly schedule or switch it to daily, pick a **Model** if you want a different one, then save.
4. Turn it on. **Test run** starts a scan now.

Each run uses [credits](/account/plans/). Rerunning your tests before devlo opens a pull request needs Startup or higher.

Tip

The scanner is an ordinary automation. Edit its **Instructions** to add exceptions for your codebase, or add **Send Email** on a paid plan to get a summary after each run.

## Related

* [How automations work](/automations/)
* [Triggers and capabilities](/automations/triggers/)
* [Code review](/code-review/) covers the pull requests your team opens.