Create your account

Hyrax finds bugs in your repo and ships a fix you merge. See it on a sample repo before connecting anything.

Email signs you in with a one-time code. No password. By continuing you accept the Terms of Use and Privacy Policy.

Verify

Check your email

Enter the 6-digit code we sent to you@company.com.

48291_

Didn't get it? Resend code

Security

Confirm it's you

Your account has a passkey. Approve with Face ID, Touch ID, or your security key.

Use a recovery code instead

Workspace

Taking you to your workspace…

acme

Workspaces

Choose a workspace

You belong to more than one. Pick one to enter.

A

acme

Team · 4 members

→

L

labs

Pro · you

→

New workspace

Name your workspace

It holds your repositories, audits, and billing. You can rename it later.

Step 2 of 3

See what Hyrax finds.

Run a read-only audit on a Hyrax sample repo first. No install, no permissions. Then point it at your own code when you want.

Hyrax starts read-only. It reads code and posts findings. It never writes to your repo until you click Fix on a specific finding.

Sample audit · hyrax/demo-api

Here's a real audit.

This is what Hyrax posts on a repo. Findings first, sorted by severity. One fix expanded so you can see the change it would ship.

2

High

3

Medium

5

Low

HIGH

SQL built from request input

api/users.ts:42 · injection

HIGH

No auth check on DELETE /projects/:id

api/projects.ts:88 · access control

MED

N+1 query in dashboard loader

api/dashboard.ts:31 · performance

FIX

Example fix · parameterize the query

api/users.ts:42

- const q = "SELECT * FROM users WHERE id = " + req.params.id
+ const q = "SELECT * FROM users WHERE id = $1"
+ const rows = await db.query(q, [req.params.id])
return rows[0]

Step 2 of 3

Connect GitHub

Authorize Hyrax to read the repos you choose. You pick which ones. Nothing else is touched.

Read code and pull requests on repos you select
Post findings as PR comments
Write access only when you click Fix, scoped to that PR

Hyrax requests no admin scope, so a repo admin can install it without an org owner. Not an admin on the repo you want? You can request access from the install screen.

Step 3 of 3

Pick one repo to start.

Start with a repo you actually ship from. You can add more later. Hyrax installs only on what you select.

◆

acme/web

TypeScript · you admin

✓

◆

acme/api

Go · you admin

→

◆

acme/infra

needs org-owner approval

request

Demo repos give weak signal. Pick something real.

First audit

Reading acme/web…

First findings in about 90 seconds. You can close this. We email you when it's done.