Documentation

Start with one repository.

Connect SafeRook, review your first finding, and keep every action within the boundaries you set.

Quickstart

Create a workspace, install the SafeRook GitHub app on a selected repository, and start in read-only mode. Rook will analyze the default branch and open findings in the workspace.

$ saferook connect github
✓ Workspace selected: acme-production
✓ Repository connected: checkout-api
✓ Initial analysis queued
CLI and API access are provisioned with your workspace. Enterprise administrators can restrict token creation and integration scopes.

Permissions

Begin with repository metadata and contents read access. Enable pull-request write access only when you want Rook to prepare fixes. SafeRook never requires permission to merge.

  • Repository contents: read for analysis, optional write for fix branches
  • Pull requests: read, plus optional write for proposed changes
  • Checks: read to verify required CI results
  • Organization members: optional read for ownership mapping

Finding-to-fix workflow

Each finding moves through five explicit states: detected, investigated, fix prepared, verified, and approved or dismissed. The activity log records the evidence and actor for every transition.

detected → investigated → fix_prepared
fix_prepared → verified → awaiting_approval

Integrations

Connect code hosts first, then add cloud and collaboration systems to improve prioritization and ownership. Integration credentials are scoped per workspace and can be revoked independently.

API

The API uses workspace-scoped bearer tokens. Keep tokens out of source control and rotate them from workspace settings.

GET /v1/findings?severity=critical
Authorization: Bearer $SAFEROOK_TOKEN

Get help

For onboarding or architecture questions, book a working session with the SafeRook team.