# Octopoda

> Octopoda scans your code for security holes, proves each one, and gives you a fix prompt for Cursor or Claude Code.

- [Octopoda: security scanning for apps built with AI](https://docs.octopoda.dev/index.md): Octopoda scans your code for security holes, shows the evidence for each one, and gives you a fix prompt to paste into Cursor or Claude Code.
- [Get started with Octopoda](https://docs.octopoda.dev/quickstart.md): Learn how to start an Octopoda trial, install the command-line tool, run your first security scan and fix what it finds, in about five steps.
- [How Octopoda finds and proves security issues](https://docs.octopoda.dev/how-it-works.md): What happens during an Octopoda scan, from the private sandbox to the proof, and which kinds of security issue Octopoda looks for in your code.
- [Run a code scan from the CLI or the web app](https://docs.octopoda.dev/scanning/code-scans.md): Start an Octopoda code scan of a project folder with the CLI, or of a GitHub repository branch from the web app, and follow it until it finishes.
- [Scan every pull request with Octopoda checks](https://docs.octopoda.dev/scanning/pull-request-checks.md): Turn on Octopoda pull request checks to scan each change on GitHub, post one summary comment, and fail the check when a serious finding is proven.
- [Scan statuses, time limits and refunds](https://docs.octopoda.dev/scanning/scan-results.md): What each Octopoda scan status means, how long each kind of scan may run, how the queue works, and when the credits for a scan are refunded.
- [Choose what the CLI uploads with .octopodaignore](https://docs.octopoda.dev/scanning/excluding-files.md): See which files the Octopoda CLI uploads for a code scan, which it always leaves out, and how to exclude more with a .octopodaignore file.
- [Read an Octopoda finding: severity, proof and location](https://docs.octopoda.dev/findings/read-a-finding.md): Understand each part of an Octopoda finding: its key and severity, what is wrong and why it matters, where it is in your code, and the proof behind it.
- [Fix a finding with Cursor or Claude Code](https://docs.octopoda.dev/findings/fix-with-ai.md): Copy an Octopoda fix prompt from the web app, the CLI or MCP into Cursor or Claude Code, review the change, and scan again to confirm the fix.
- [Triage findings: fixed, false positive and risk accepted](https://docs.octopoda.dev/findings/triage.md): How Octopoda finding statuses work, how findings close when a re-test cannot reproduce them, and how to mark a false positive or accept a risk.
- [Connect GitHub with the Octopoda GitHub App](https://docs.octopoda.dev/integrations/github-app.md): Install the Octopoda GitHub App to scan repositories from the web app and check pull requests, choose which repositories it can read, and see its permissions.
- [Use Octopoda from Cursor and Claude Code over MCP](https://docs.octopoda.dev/integrations/mcp.md): Connect the Octopoda MCP server to Cursor or Claude Code so your AI tool can start scans, check progress, list findings and fetch fix instructions.
- [Run Octopoda scans in CI with the CLI](https://docs.octopoda.dev/integrations/ci.md): Run an Octopoda code scan from GitHub Actions or another CI system with OCTOPODA_TOKEN, and fail the build when a serious finding is proven.
- [Octopoda plans, credits and what each scan costs](https://docs.octopoda.dev/billing/plans-and-credits.md): Compare the Builder, Pro and Team plans, see how many credits each kind of scan uses, and work out which plan fits how often you scan.
- [How the Octopoda free trial works](https://docs.octopoda.dev/billing/free-trial.md): The Octopoda free trial lasts 14 days, includes 5 credits and needs a card. Learn when you are charged, how to cancel, and the one-trial-per-person rule.
- [Change, cancel or pay for your Octopoda plan](https://docs.octopoda.dev/billing/manage-billing.md): Upgrade or downgrade your Octopoda plan, buy top-up credits, update your card, download invoices, cancel, and fix a failed payment from the Billing page.
- [Share Octopoda with your team: members and roles](https://docs.octopoda.dev/account/teams.md): Invite people to your Octopoda account on the Team plan, choose between the owner, admin and member roles, and see what each role can do.
- [Choose which Octopoda emails you get](https://docs.octopoda.dev/account/notifications.md): Turn Octopoda's emails on or off: finished scans, critical and high findings, low credits and failed payments, and see who receives each one.
- [Delete your Octopoda scan data or account](https://docs.octopoda.dev/account/delete-data.md): Delete all of your Octopoda scan data, or delete your account entirely, from Settings. See what each option removes and what it leaves in place.
- [How Octopoda handles your code and data](https://docs.octopoda.dev/security/your-code.md): Where your code goes during an Octopoda scan, how the sandbox is isolated, which AI provider sees it, how long data is kept, and how to report an issue.
- [Troubleshoot Octopoda sign-in, scans and pull request checks](https://docs.octopoda.dev/help/troubleshooting.md): Fixes for common Octopoda problems: CLI sign-in errors, scans that will not start or stay queued, pull requests that are not scanned, and missing emails.
- [Octopoda frequently asked questions](https://docs.octopoda.dev/help/faq.md): Answers to common questions about Octopoda: what it scans, how long scans take, what a clean scan means, AI training, credits, refunds and GitHub support.
- [Install and update the Octopoda CLI](https://docs.octopoda.dev/cli/install.md): Install the octopoda command-line tool on macOS or Linux with one command, choose where it goes, pin a version, verify its signature, and keep it up to date.
- [Octopoda CLI commands and flags](https://docs.octopoda.dev/cli/commands.md): Reference for every octopoda command: login, scan, status, findings, fix, mcp, whoami, logout, update and version, with their flags and output.
- [Configure the Octopoda CLI: sign-in file and environment](https://docs.octopoda.dev/cli/configuration.md): Where the Octopoda CLI stores your sign-in, the environment variables it reads, including OCTOPODA_TOKEN for CI, and the exit codes it returns.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.