Docs

SafeWeave on GitHub

On the Cloud plan, SafeWeave scans your connected repositories in the cloud and posts a GitHub Check Run on every push and pull request — no CI config to write.

Connect a repository

1. Go to Integrations in your dashboard and connect GitHub.
2. Authorize access to the specific repositories you want scanned.
3. SafeWeave registers a webhook and runs the first scan.

What you get on each PR

• A SafeWeave Security Scan check that fails when critical or high findings are present.
• A Coverage block first — which scanners ran — so an incomplete scan is never read as a clean one.
• The top findings with severity, file:line, and CWE, plus inline annotations on the diff.
• A "fix these with your AI" prompt: connect mcp.safeweave.dev/mcp in Cursor or Claude Code and let your agent apply the fix.

Permissions

SafeWeave requests only what it needs to read your code for a scan and write the check result back. Tokens are encrypted at rest, and the cloned checkout is deleted once a scan completes — we retain findings, never your source.

Disconnecting

Disconnect a repository from the Integrations page at any time. You can also revoke SafeWeave's access from your GitHub settings; doing so stops future scans and the stored access token is no longer usable.