← Back to SolSentinel

SolSentinel GitHub App

Automatic smart contract security scanning for every pull request. Catch vulnerabilities before they reach production.

How It Works

When you open or update a pull request with Solidity file changes, SolSentinel automatically runs Wake (static analysis) and Solhint (linting) on the changed .sol files and posts a summary comment on the PR.

The comment includes vulnerability names, severity levels, SWC references, and links to notable real-world exploits. A deep link to the full scan report lets you explore detailed findings.

Setup Guide

1 Install the GitHub App

Visit the SolSentinel GitHub App page and click Install. Choose which repositories to grant access to. We recommend starting with a single repository.

The App only requests read access to code and pull requests, plus write access to PR comments.

2 Link to Your SolSentinel Account (Optional)

After installation, go to Account Settings in SolSentinel and find the GitHub App Integration section. Enter your installation ID to link it to your paid tier.

Without linking, scans run on the free tier (Wake + Solhint only). Linked installations inherit your subscription tier for enhanced features.

3 Open a Pull Request

Create or update a pull request that includes .sol file changes. SolSentinel will automatically scan the changed files and post a comment within 30–60 seconds.

Test files (test/, .t.sol), library files (lib/), and migration files are automatically skipped.

Example PR Comment

SolSentinel Security Scan

Found 3 issue(s) across 2 file(s): 1 Critical1 High1 Medium

Severity File Line Issue Reference
Critical Vault.sol 42 Reentrancy
State change after external call
SWC-107
The DAO ($60M lost)
High Token.sol 18 Access Control
Missing modifier on sensitive function
SWC-105
Medium Vault.sol 55 Unchecked Return
Return value not checked
SWC-104

Powered by SolSentinel • Wake + Solhint static analysis • 450ms • View full report

Tier Comparison

What you get with each tier in GitHub PR scans:

Feature Free Pro Builder Protocol Team Audit Infrastructure
IR Static Analysis Yes Yes Yes Yes
Solhint Linting Yes Yes Yes Yes
Claude AI Semantic Analysis - Yes Yes Yes
Mythril + Foundry + Wake (full stack) - Yes Yes Yes
Scans per Repo / Day 20 50 Custom Unlimited
Scan Report Deep Link Yes Yes Yes Yes
AI-Generated Fix Code - Yes Yes Yes
Dual-AI Consensus (Claude + Grok) - - - Yes
Scan History Dashboard - Yes Yes Yes
Compliance Attestation (MiCA / FIT21 / SOC 2 / ISO 27001) - Pay-per ($499 / $199) 5 bundled / mo Unlimited

Rate Limits

To prevent abuse, scans are rate-limited per repository and per organization:

ScopeLimit
Per repository20 scans / day (configurable)
Per organization100 scans / day (configurable)
Max files per PR15 .sol files
Max lines per file500 additions
Scan timeout120 seconds

What Gets Skipped

The scanner automatically ignores files in these directories:

PatternReason
test/ / tests/Test files
mock/ / mocks/Mock contracts
lib/Foundry dependencies (OpenZeppelin, etc.)
.t.solFoundry test files
script/Foundry deploy scripts
migrations/Migration scripts
node_modules/NPM dependencies

Frequently Asked Questions

Does the app read my source code?
The app fetches the content of changed .sol files to run static analysis. Files are processed in an isolated temporary directory and deleted immediately after scanning. No source code is stored.
What permissions does the app need?
Read access to code and pull requests, plus write access to PR comments (to post scan results). No write access to code is requested.
Can I use it without a SolSentinel account?
Yes. Unlinked installations run on the free tier automatically. Link your installation to a paid account for enhanced features.
How do I uninstall?
Go to your GitHub organization or account settings, find the SolSentinel App under Applications, and click Uninstall. The installation will be deactivated in SolSentinel automatically via webhook.
Why do I only see Wake and Solhint results?
PR scans use lightweight tools for fast feedback (under 60 seconds). For full analysis with Mythril, Foundry, Claude AI, and Grok, submit your contract through the main SolSentinel audit page.

← Back to SolSentinelPrivacy PolicyTerms of Service