Frequently Asked Questions

Erbab.dev is an automated security pipeline that keeps constant watch over your source code. On every pull request it scans only the changed code, and once a month the whole repository; it verifies the findings, explains each one in plain language, shows you how to fix it and, where it makes sense, prepares the fix PR for you.

Nothing to install. You connect your GitHub account and choose which repositories the Erbab.dev app can access; it takes a few minutes. No changes to your CI/CD or your code.

Of course. Your first full scan is free and we don't ask for a card. When it's done you'll see every finding and the full details of the most critical one. Details for the rest, fix PRs and the PDF report come with a subscription.

We currently work with GitHub. Because the analysis isn't tied to a fixed rule set, it works with most common languages such as JavaScript/TypeScript, Python, Ruby, PHP, Java, Go and C#. If you use GitLab or Bitbucket, let us know; we set our priorities around what you need.

It's a fair question; we'd ask the same. Your code is copied into an isolated, temporary environment only for the duration of the scan and deleted as soon as it finishes; we don't keep a permanent copy. Your code is never used for anything else, including model training.

Only on the repositories you choose: reading code, commenting on PRs, showing the scan result on the PR and opening fix PRs. You can revoke access from your GitHub settings at any time with one click.

No. PR comments only include the finding's name, severity and location. Sensitive details, such as how an issue could be exploited, are only shown in your dashboard and PDF report, visible only to you.

Your code is processed in data centres in the European Union, in an isolated environment created for each scan, and deleted after the scan. If your code must never leave your infrastructure, our Enterprise plan includes a self-hosted option.

PR scans only look at the changed code, so they usually finish within a few minutes to half an hour. A full scan of the whole repository can take 15 to 60 minutes depending on its size. No need to wait around; we'll email you when it's done.

Not burying you in noise is one of our top priorities. Before reporting an issue, the system tries to confirm that it is actually exploitable. Each finding explains why it's a problem, what the impact could be and the evidence, so you can decide quickly.

No, nothing is merged without your approval. Fixes are opened as draft PRs; your team reviews them, runs the tests and merges when they're happy.

An executive summary, a risk assessment, a detailed explanation of each finding with fix recommendations, plus OWASP Top 10, KVKK, ISO 27001 and PCI-DSS mappings. Reports are available in Turkish or English and ready to share with your auditors and leadership.

To be honest: no, it complements one. A pentest usually happens once a year; Erbab.dev watches your code every day, on every change, and closes the gap between pentests. If you need an expert-reviewed pentest, that's exactly what our Enterprise plan is for.

Starter is $99 per month, or $79 per month billed yearly: 1 repository, a full scan every month and 40 PR scans a month. Pro is $350 per month, or $200 per month billed yearly: 1 repository, a full scan every week and 60 PR scans a month. Both include PDF reports and fix PRs, and you can add repositories. Codebases over 150K lines per repository and unlimited usage are covered by Enterprise.

If you cancel within the first 14 days of your subscription, we refund the full amount, no questions asked. After that you can cancel any time and keep using it until the end of the period you've paid for.

Payments are taken by card through Dodo Payments. Your invoices, card details and the cancel option are on the Billing page in your dashboard.

Yes. The Enterprise plan includes unlimited repositories, source code and graybox pentests, expert-reviewed reports, self-hosted deployment, SSO and priority support. Book a 30-minute call to talk about what you need.