How Launchioo Works

Launchioo automatically reviews your GitHub pull requests for security issues — before code gets merged. It scans only the new lines added in each PR diff using a deterministic rule engine (no AI inference).

When you open or update a pull request, Launchioo scans the changes and then:

• Leaves a comment on the PR with score, risk index, and findings
• Shows a pass, warn, or fail check on the pull request (like your other CI checks)
• Saves a history of reviews you can view on your dashboard

You keep working in GitHub. Launchioo works out of the box — no config files required. You can optionally add a launchioo.yml at your repo root to tune rules, ignore paths, or change whether critical findings fail the check.

All you need is:

• A GitHub account
• Access to the repositories you want to protect (personal repos or repos in an organization you belong to)
• Permission to install GitHub Apps on that account or organization (org owners can restrict this)

If you are installing on a company organization, an admin may need to approve the app first — that is standard GitHub behavior when org settings require admin approval for new app installations.

The whole setup takes a few minutes. Here is exactly what to do:

1. 1

   Create your account

   Click Sign up with GitHub and authorize Launchioo with your GitHub account. We use GitHub to sign you in — there is no separate password to remember.

2. 2

   Install the GitHub App

   After signing in, click Install GitHub App in the top navigation or from your dashboard. You must be signed in first — we will ask you to log in if you are not.

   GitHub opens in a new tab and asks where you want to install the app.

3. 3

   Pick account and repositories

   On GitHub, choose:

   • Your personal account or an organization you have permission to install apps on
   • Only select repositories — on the Free plan, pick exactly one repository to scan (do not use All repositories)

   Click Install (or Request if your org requires admin approval). Once approved, GitHub completes the installation the same way.

4. 4

   Choose your repository (Free) or sync (Pro)

   After installation, GitHub redirects you back to Launchioo.

   Free plan: you'll pick which single repository to connect on the repository chooser. Your dashboard lists that repo once connected.

   Pro plan: open your dashboard and click Sync repositories to link all repos from your installation.

5. 5

   Open a pull request

   Create a pull request in any connected repo, the same way you always do. Within a short time after opening the PR (or pushing new commits to it), Launchioo will scan your changes and post results on the PR.

   Tip: Draft pull requests are not scanned until you mark them as ready for review.

If you write code

• Open or update a pull request as usual
• Wait a moment after each push for the scan to finish
• Read the Launchioo comment on your PR
• Check the pass, warn, or fail status in the PR checks area
• Fix any issues, push again, and the comment updates automatically

If you manage a team

• Visit your dashboard to see connected repos, recent reviews, and common issues across PRs
• On Pro, open your dashboard and use Merge blocking (Pro) to require the Launchioo check — or configure it manually in GitHub → Settings → Branches (Pro plan required for red fail checks; Free uses advisory neutral checks)
• To add more repositories later, click Install GitHub App again and update your repository selection on GitHub. Free users can switch their linked repo from the dashboard via Choose repository

Launchioo reviews the new lines you add in each pull request. Findings come from static rules plus specialized engines for SSRF, CSRF, auth bypass, supply chain, taint flow, and exploit chains. Context can adjust severity (for example, cleartext HTTP in an auth flow ranks higher than in a comment).

Findings are grouped by severity. A separate policy decides whether the PR check passes, warns, or fails:

• FAIL — one or more critical findings (when critical blocking is enabled in config)
• WARN — high or medium findings, or security score below thresholds.blockMergeBelowScore (default 60), with no critical
• PASS — no findings, or low-severity only

The security score also affects policy: when it falls below thresholds.blockMergeBelowScore (default 60), the check warns even if only low-severity findings remain. Set it to 0 in launchioo.yml to disable score-based warnings.

Policy status (what drives the GitHub check)

Each scan gets a policy outcome based on active finding severities (suppressed and ignored findings are excluded first):

• PASS — check is green (success). No high or medium issues; low-severity findings alone still pass.
• WARN — check is yellow (neutral). At least one high- or medium-severity finding, or the security score is below your configured threshold (default 60), and no critical (or critical blocking is disabled).
• FAIL — check is red (failure). At least one critical finding when thresholds.blockOnCritical is true (the default). Pro plan only — Free downgrades FAIL to neutral (warn).

Security score & risk index (informational)

Alongside policy status, every scan reports two metrics to help you prioritize:

• Security Score (0–100) — starts at 100 and deducts points per finding (low −1, medium −3, high −10, critical −25). Below the configured threshold (default 60) triggers a warning check.
• Risk Index — weighted exposure: critical ×10, high ×3, medium ×1. Useful for comparing PRs at a glance on your dashboard.

On your pull request

You will see two things on each scanned PR:

• A comment from Launchioo — shows security score, risk index, policy status, severity breakdown, and the top issues with file name and line number. The same comment updates when you push new commits.
• A status check — shows up alongside your other checks as Launchioo Security Scan. Green = pass, yellow = warn, red = fail. Click it for the full report.

On your dashboard

Sign in to see a summary across all your connected repositories:

• Which repos are connected
• Recent scans with score, risk index, policy status, and check result
• A breakdown of the most common issues found
• Pro: security debt dashboard, repository rankings, security goals, 30-day trend analytics, and Explain with AI on individual findings

Pull request scanning is fully deterministic — Launchioo does not use AI to decide whether code is vulnerable. On Pro, you can optionally request AI help for a specific finding from your repository dashboard.

Click Explain with AI on any finding to receive:

• AI remediation — a concise overview of the issue and recommended fix approach
• Secure code examples — a copy-paste-ready secure code snippet addressing the finding
• Step-by-step fixes — ordered, actionable remediation steps

Pro includes 100 AI requests per calendar month (UTC). Using AI assistance on a paid subscription affects refund eligibility — see our refund policy.

Pro plan: add a launchioo.yml file at your repository root to tune rules, thresholds, ignore paths, and inline comments. The scanner loads this file from the PR head commit on every scan.

Free plan: scans use default rules and thresholds. You can still suppress individual lines with inline launchioo-ignore comments.

Supported options on Pro:

• Per-rule severity — override individual rule IDs under rules: or severityOverrides:
• Disable rule categories — turn off secrets, DOM XSS, GitHub Actions, network, or supply-chain detection under features:
• Ignore paths or rules — skip files via ignore.paths, or disable specific rule IDs via ignore (array) or suppress:
• Score warning threshold — set thresholds.blockMergeBelowScore (default 60; use 0 to disable score-based warnings)
• Critical blocking — set thresholds.blockOnCritical: false to downgrade critical findings to a warning instead of failing the check. On the Free plan, blocking is always off regardless of this setting.
• Inline review comments — toggle with inline_comments and filter by severity with inline_comments_severity

Example:

thresholds:
  blockOnCritical: true
  blockMergeBelowScore: 60

features:
  enableSupplyChainDetection: true

ignore:
  paths:
    - "docs/**"
    - "test/fixtures/**"

rules:
  console-log: low

You can also suppress individual lines with an inline comment:

console.log("debug"); // launchioo-ignore: console-log

Or use .launchiooignore or launchioo-ignore-file.json for path- or rule-based suppressions. Suppressed findings are stored separately and excluded from score and policy.

My PR was not scanned — why?

• The repository might not have been included when you installed the app — try installing again and selecting it
• The PR might still be a draft — mark it ready for review first
• Give it a minute after pushing, then refresh the PR page

Free plan limits

• 5 pull request scans per calendar month (UTC)
• 1 full repository audit per calendar month (UTC)
• 1 connected repository at a time
• Last 10 scans visible on the dashboard
• Exploit chain depth capped at 2 hops
• Advisory checks only — no merge-blocking fail status
• No Executive PDF Report downloads

Pro adds merge blocking, unlimited scans, advanced dashboard analytics, Executive PDF reports, and more. See pricing for Pro benefits.

My repos are not showing on the dashboard

• Make sure you are signed in with the same GitHub account you used to install the app
• Free plan: click Choose repository on your dashboard to link your repo
• Pro plan: click Sync repositories to refresh the list
• If you installed on an organization, confirm an admin approved the installation (if your org requires it)

Do I need to change anything in my codebase?

No. Once the GitHub App is installed on your repositories, scans run automatically on every pull request. Configuration files are optional — add launchioo.yml only if you want custom rules, ignores, or to change critical blocking behavior.

Can I use this on an organization?

Yes. During installation on GitHub, choose your organization instead of your personal account. Launchioo stores the org installation and scans repos you grant access to, the same as personal repos. If your organization requires admin approval for new apps, an org admin must approve the request before scans begin — that is controlled by your GitHub organization settings, not by Launchioo.

Sign in with the GitHub account that performed (or requested) the installation so the dashboard shows your connected org repositories.