Quickstart
From install to your first flagged candidate.
Deton scans pull requests, not full repositories. Connect a repo, open a PR, and Deton scans the diff — no scheduled scans, no default-branch scans.
Install the Deton GitHub App
Grant Deton read access to the repositories you want scanned. Deton reads pull-request diffs, not full checkouts — nothing is pulled outside of a PR event.
Open or push to a pull request
Deton scans on pull_request.opened and pull_request.synchronize only. No scheduled repo scans, no default-branch scans, no arbitrary target URLs — PR-only, by design.
Live todayDeton scans the diff for exploitable candidates
The diff-based candidate finder flags likely SQL injection, command injection, and other sink patterns in the pull request's changed lines. Every candidate raised this way is inconclusive by design — a diff scan alone can raise a candidate, but it can never mark one confirmed, and its absence is never proof the code is safe.
See flagged candidates in your Deton dashboard.
A sandbox oracle confirms real exploits and posts a Check
This step does not exist yet. Confirming a candidate requires actually running the pull request's changed app in an isolated sandbox and observing a real oracle signal — that sandbox runner is not implemented. No candidate is ever labeled "confirmed" today, and Deton does not post a GitHub Check yet.
Coming soonWhat's live vs. what's coming
Every item below links to real code or a real decision record — not a roadmap promise.
Live today
- Diff-based candidate detection for SQL injection, command injection, and related sink families
src/core/deton/diff-scan.ts - Signature-verified GitHub webhook that creates a scan run from a pull-request event
src/app/api/github/webhook/route.ts - Org-scoped dashboard listing every flagged candidate for your connected repositories
src/app/[locale]/(auth)/dashboard/page.tsx
Coming soon — not live yet
- A sandbox runner that actually executes the pull request's changed app and observes real exploit behavior
docs/adr/0007-deton-sandbox-runner.md (status: proposed) - A posted GitHub Check reflecting a confirmed verdict on the pull request
docs/product/deton-mvp/06-github-pr-workflow.md
See it on your own pull request
Install the GitHub App, open a PR, and watch Deton flag candidates on your own diff.