Autopilot
Autopilot is part of the Team plan. It finds every repository the dagsec GitHub App can reach, and in the desktop app the projects on your computer, and analyses each one without anyone starting a scan: every day, and whenever a repository gets new commits. It reports and recommends; it never changes code or opens pull requests.
Turning it on
- Install the GitHub App on the accounts or organizations to watch, and choose which repositories it may read. Autopilot sees only those; to watch more later, see Choosing repositories.
- In the dashboard, open Autopilot and switch it on. The first run starts right away.
The Autopilot page guides you through both: until the App is installed it shows the steps and an Install the GitHub App button, and afterwards a Choose repositories link for each installation.
Repositories you add to the App later are picked up on the next run; ones you remove or delete drop out, and archived ones are listed but skipped. Run now analyses again anything that changed or is more than an hour old.
Projects on your computer
In the desktop app, Autopilot also watches the git repositories on your computer, under the This computer tab of the same page. It needs no GitHub App: it reads the projects where they are. Switch it on and it starts with the usual code folders that exist (such as Desktop, Documents, Projects, dev, code, source/repos); add or remove folders there.
- It looks up to six folders deep, skips dependency, build and hidden folders (
node_modules,target,vendor,.venvand the like), and doesn't look for repositories inside a repository. - A project is analysed again when it gets a new commit, and once a day for new advisories and releases, while the app is running. Run now analyses anything with a new commit or older than an hour.
- Everything runs on your computer: project paths and results stay there and nothing is sent to dagsec. As in a Local scan, dagsec asks the providers whether a leaked credential still works.
- New serious issues show a desktop notification.
What each analysis contains
Each repository is scanned the same way as a dashboard scan: its full git history, its lockfiles and its manifests.
| Part | What it shows |
|---|---|
| Secrets | Secrets in git history, those in application code first. Test files, docs, examples and test keys are listed but don't count against the repository |
| Known vulnerabilities | Advisories from OSV.dev for every pinned package version, direct and transitive |
| Recommended updates | For each vulnerable package version, one version that fixes all of its advisories (the highest "fixed in" among them), and direct dependencies behind their latest release. Major version jumps are marked, and each row has the command to copy (npm, pip, cargo, go, dotnet) |
| Unhealthy packages | Direct dependencies whose health score is under the threshold |
| License violations | Packages whose license your .dagsec.toml blocks |
| New since the last analysis | Serious issues that weren't there the previous time |
A repository is Critical when it has a secret in code, a credential its provider confirms still works, or a critical vulnerability; it Needs attention for high vulnerabilities, license violations or unhealthy packages; otherwise it's OK.
How it stays accurate
- Versions are compared only when both are plain dotted numbers (
1.2.3,v2.0). A version scheme dagsec can't compare is never called "behind". - If OSV.dev can't be reached during a run, the analysis says vulnerabilities weren't checked and the repository needs attention, rather than showing it as clean.
- If a run fails for a repository (for example it's larger than 1 GB), the previous analysis stays and the error is shown, so a failed run never hides known issues.
Notifications
After each run, if any repository has new serious issues (secrets in code, working credentials, critical or high vulnerabilities, license violations), you get one notification listing them in the dashboard's notifications menu.
Limits
Autopilot doesn't use your plan's monthly dashboard scans. One run analyses up to 100 repositories; the rest are analysed on the next runs. Repositories larger than 1 GB are skipped with an error; scan those with the GitHub Action.