Getting started

Akesis reads the findings your scanners raise, re-scores them for your own code, and turns the fixes into pull requests. It merges fixes on its own only as far as you allow, repository by repository, and records every decision it makes in an audit log nobody can edit.

How it fits together

1. Code hosts (GitHub, GitLab, Bitbucket) give Akesis your repositories, their pull requests and their CI results.
2. Scanners (Dependabot, Snyk, Strix, anything that writes SARIF) report vulnerabilities. Reports of the same flaw are merged into one finding.
3. The backlog lists the findings that still need action, most urgent first, with the reasons for each priority.
4. Fix pull requests come from the tools you already use (Dependabot, Snyk, Renovate) or, for npm, from Akesis itself.
5. Autonomy decides, per repository, whether Akesis only suggests, opens a draft, opens a pull request for review, or merges on its own when every safety check passes.

Roles

Everyone signs in with your company's identity provider. Each person has one role:

Role	Can
Auditor	Read everything, including the audit log. Changes nothing.
Engineer	Change a finding's status, open Jira issues, and stop autonomy in an emergency.
Engineering lead	Everything an engineer can, plus change repository policies, resume after a stop, revert a fix, and turn on Akesis's own fixes for a repository.
Security owner	Everything an engineering lead can, plus accept a risk.
Admin	Everything, plus users, integrations and audit-log retention.

First steps

The Get started card at the top of the backlog (for admins, engineering leads and security owners) follows these steps and ticks each one when Akesis sees it happen. An admin can hide it for everyone.

1. Connect a code host. In Integrations → Code hosts, connect GitHub, GitLab or Bitbucket and choose repositories. New repositories start at suggest-only (T0): Akesis explains, and changes nothing. See Code hosts.
2. Connect your scanners. Dependabot comes with GitHub. Add Snyk, Strix or SARIF uploads in Integrations → Scanners. See Scanners and uploads.
3. Review the backlog. Open Backlog and read "Why this priority" on a few findings. See Backlog and findings.
4. Look at a fix. When Dependabot, Snyk or Renovate opens a fix pull request, Akesis links it to the findings it fixes and comments on it with its decision.
5. Raise autonomy where you're comfortable. On Autonomy, pick a repository and set its policy. Auto-merge (T3) needs a verified test suite and a stated reason. See Autonomy and policies.
6. Bring in your team. Add people in Admin → Users, connect Jira and Slack in Integrations → Tickets and alerts.

If anything ever looks wrong, Stop all autonomy in the header drops every repository to suggest-only at once.