Frequently asked questions
Short answers to the questions that come up most often.
Do you run my code?
No. Not your code, not your build, not your tests, and not your dependencies' install scripts. See Security and your code.
Do you keep my source code?
No. A snapshot exists only while a review is running and is destroyed afterwards. What is kept is findings, short evidence excerpts, coverage and reports.
Is this a penetration test?
No. It is automated review of the code in your repository. It does not attempt to exploit anything, does not test running systems, and cannot tell you that your application is free of problems.
Does a clean report mean my code has no problems?
No, and the report is written to make that clear. It means the tools that ran found nothing in the code they were able to read. The coverage section tells you what that excludes.
Can Monterva change my code or open pull requests?
No. The GitHub App holds read-only permissions — contents and metadata — and nothing else.
Can it see repositories I did not select?
No. You choose the repositories in GitHub's own interface, and the App has no visibility into the ones you did not choose.
What does the score mean?
It is a relative indicator, useful mainly for seeing movement between reviews. It is not a safety rating and does not translate to any external standard.
Why is a finding marked "requires human review"?
Because the tooling could not settle whether it is a real problem in your code. Anything with low confidence is marked this way. It is an honest statement of uncertainty rather than a hedge.
Why does it report something I have already disabled in my own configuration?
Monterva deliberately does not read your repository's analyser configuration — an audit the audited repository can edit is not an audit. Mark the finding ignored in Monterva instead, and that decision persists across reviews.
How often should I run a review?
After meaningful changes, and before you launch anything. Re-running after a fix is how you confirm the fix worked.
What happens if I remove the GitHub App?
Reviews stop working and your settings page says the connection is gone. Nothing you have already run is deleted.