Skip to content

Reference

FAQ

Straight answers on code access, data, cost, noise and what Forseti does when something goes wrong.

Does Forseti store our code?

No copy of your repository is kept. Diffs are fetched from GitHub when a review runs, and the dashboard fetches a PR's patch live when you open it (held in memory for two minutes, never written to the database).

What is stored is the review itself: findings, their explanations and, by default, the short quoted evidence and suggested fix, which are public on the PR anyway. Switch off store snippets in Settings and Forseti keeps the prose only: no suggestion, no quoted code, and the anchored lines as a hash so fixed detection still works. Findings older than the retention period (90 days by default, 7 to 3,650) are deleted nightly.

What stops secrets reaching a model?

A deterministic scan runs before any model call. Files such as .env*, *.tfvars, credential files and private keys are never sent, and secret-shaped values in other files (API keys, tokens, connection strings with passwords, private key blocks) are redacted first. The same redaction runs on the PR title and description.

Can Forseti push to our repositories?

No. The GitHub App has read-only access to code. Fixes arrive as suggestion blocks that a person commits under their own name. The full list is in Install the GitHub App.

Will Forseti block our merges?

The check run always finishes with a neutral conclusion, and its title says whether the PR is clear or how many blocking findings are open. Use that in your process as you see fit; Forseti does not fail builds on its own.

How is a review priced?

In credits: one credit is £0.01. Before a review runs, Forseti estimates it from the PR's size, the depth and the checks switched on, and shows the estimate on the check run. You are charged the actual cost, not the estimate. Caps per PR, per repo and per workspace stop surprises; see Policies & depth.

What happens when we hit a cap?

Whatever you chose: drop to Glance, or pause. Either way Forseti says so on the PR. It never skips a review silently. A one-off Deep review above the cap asks for @forseti confirm with the price first.

How do we keep the comments down?

Three controls. The strictness profile decides which severities go inline (quiet posts Blocking only). The inline cap limits comments per review (7 by default). And dismissing a finding as “not useful here” teaches Forseti to stop raising that kind of finding in that repo. Everything not posted inline is still listed in the summary.

Why was a pull request not reviewed?

Forseti skips, for free, when:

  • the PR is a draft (it reviews when marked ready);
  • the base branch is not targeted for that repo;
  • the author is a bot, such as Dependabot or Renovate;
  • only lockfiles changed;
  • the title contains [skip review], or an ignore label is set;
  • the PR comes from a fork whose author is not a member or collaborator;
  • reviews on the PR were paused with @forseti pause.

@forseti config on the PR shows the settings that applied and where each came from.

Can a pull request talk Forseti out of a finding?

No. PR titles, descriptions and code are treated as data, never as instructions. Instructions come only from Forseti itself and from your own configuration on the base branch.

What if a review runs out of time?

Each depth has a time budget (3 minutes for Glance, 8 for Standard, 15 for Deep). When it runs out, Forseti posts the findings it has verified and marks the review partial, listing the files it did not get to. The same happens for files a model declines to review. Nothing is presented as checked when it was not.

Which AI does Forseti use?

Large language models from one commercial AI provider, named in our sub-processor list. A fast triage pass sorts the PR and handles low-risk files; a deep reasoning pass finds issues, and a second, independent check verifies each one; Deep adds an adjudication step for blocking or uncertain findings. A finding is dropped unless its cited line really contains the quoted code.

Do you support GitLab, Bitbucket or Azure DevOps?

GitHub is live. Adapters for GitLab, Bitbucket and Azure DevOps are built; reviews on them switch on in a coming release. See Integrations for what that means today.