diff --git a/code-review/billing.mdx b/code-review/billing.mdx index 1a129bf..180eb1b 100644 --- a/code-review/billing.mdx +++ b/code-review/billing.mdx @@ -1,78 +1,57 @@ --- -title: "Trial and billing" -description: "Understand Code Review payment methods, trials, seats, and subscription lifecycle." +title: "Code Review Billing" +description: "Free trial, seats, spillover, and subscription lifecycle for Code Review." --- -Code Review billing is based on Code Review seats. A seat covers one developer whose pull requests or merge requests can be reviewed by Hacktron. +Each developer with Code Review enabled counts as one seat. Seats can be assigned manually, or Hacktron can assign seats automatically when developers open pull requests in covered repositories. -Organization owners manage payment methods, invoices, billing details, subscription state, and promotion codes from **Billing**. +Code Review is billed as a monthly subscription. At the end of each billing period, your organization is charged for the number of seats that were active during that period. -## Start a trial + + If a developer no longer needs Code Review, remove their seat from **People**. + + The removed seat can be reassigned to someone else during the same billing period, but removing a seat in the middle of the billing period will not reduce the seat count for that period. + -Code Review has a free trial for new organizations. +## Start your Free Trial - Go to **Billing** as an organization owner. - - Review and accept the terms of service and start the trial. No payment method - is required during the free trial. + + Open Billing from the side bar. You must be an organization owner to see this.  + + ![Billing Dashboard](/images/billing-dashboard-1.png) + + + Review and accept the terms of service and start the trial. No payment method is required during the free trial. - - Once the trial is active, Hacktron starts running code reviews on all - covered repositories. + + Once the trial is active, Hacktron starts running code reviews on all covered repositories. -## How seats are billed - -Each developer with Code Review enabled counts as one Code Review seat. -Seats can be assigned manually, or Hacktron can assign seats automatically -when developers open pull requests in covered repositories. - -Code Review is billed as a monthly subscription. At the end of each billing period, -your organization is charged for the number of Code Review seats that were active -during that period. +## End Trial Early - - If a developer no longer needs Code Review, remove their seat from **People**. - -The removed seat can be reassigned to someone else during the same billing period, -but removing a seat in the middle of the billing period will not reduce the -seat count for the current billing period. - - - -## End a trial early - -Ending the trial early allows you to start the paid plan immediately and enable [spillover usage](/code-review/spillover-usage). +Ending the trial early allows you to start the paid plan immediately and enable [**spillover usage**](https://docs.hacktron.ai/code-review/spillover-usage). - Go to **Billing** as an organization owner. Go to **Billing** and end the trial early to start the paid plan immediately. - End trial early - + + ![End trial early](/images/end_early.png) + - Go to **Usage** to enable spillover billing to continue reviewing pull requests or merge requests - after the pooled review limit is reached. + Go to **Usage** to enable spillover billing to continue reviewing pull requests or merge requests after the pooled review limit is reached. -## Cancellations and resubscription +## Cancellations and resubscriptions -If you cancel during a trial or paid subscription, Code Review remains available -until the end of the current trial or billing period. After cancellation takes effect, -new pull requests or merge requests are no longer reviewed. +If you cancel during a trial or paid subscription, Code Review remains available until the end of the current trial or billing period. After cancellation takes effect, new pull requests or merge requests are no longer reviewed. -If the organization resubscribes later, Code Review starts as a paid subscription. -The free trial does not restart. +If the organization resubscribes later, Code Review starts as a paid subscription. The free trial does not restart. - + Understand pooled review limits and overage pricing. - + \ No newline at end of file diff --git a/code-review/findings-feedback.mdx b/code-review/findings-feedback.mdx index 7c4583c..2e6b1fd 100644 --- a/code-review/findings-feedback.mdx +++ b/code-review/findings-feedback.mdx @@ -120,6 +120,12 @@ If a [fail-on gate](/code-review/config#fail-the-check-on-findings) is configure For example, if the fail-on gate is configured to fail on high severity findings, triaging a high severity finding as a false positive or accepted risk will update the GitHub check (or GitLab commit status) to pass. Reopening the finding will cause the check to fail again. +## Remediate a finding + +Hacktron can also fix a finding for you. Select **Remediate** on a finding in the web platform and a Hacktron agent writes a fix and opens a pull or merge request with it. You can also remediate qualifying findings automatically with [automations](/platform/automations/overview). + +See [Remediation](/platform/automations/remediation) for how runs work, where the fix lands, and billing. + ## Feedback loop Triage feedback helps Hacktron adapt to your codebase. Comments and project rules diff --git a/docs.json b/docs.json index ca40c1b..f15bd71 100644 --- a/docs.json +++ b/docs.json @@ -69,12 +69,21 @@ "platform/context/threat-models" ] }, + { + "group": "Automations", + "pages": [ + "platform/automations/overview", + "platform/automations/remediation", + "platform/automations/credits" + ] + }, { "group": "Account", "pages": [ "platform/account-settings", "platform/security-settings", - "platform/organization-settings" + "platform/organization-settings", + "platform/billing" ] }, { diff --git a/images/autofix-1.png b/images/autofix-1.png new file mode 100644 index 0000000..e9926f5 Binary files /dev/null and b/images/autofix-1.png differ diff --git a/images/autofix-2.png b/images/autofix-2.png new file mode 100644 index 0000000..6823077 Binary files /dev/null and b/images/autofix-2.png differ diff --git a/images/autofix-3.png b/images/autofix-3.png new file mode 100644 index 0000000..508087d Binary files /dev/null and b/images/autofix-3.png differ diff --git a/images/automation-run-history.png b/images/automation-run-history.png new file mode 100644 index 0000000..0a59fc9 Binary files /dev/null and b/images/automation-run-history.png differ diff --git a/images/billing-dashboard-1.png b/images/billing-dashboard-1.png new file mode 100644 index 0000000..a2d7fd2 Binary files /dev/null and b/images/billing-dashboard-1.png differ diff --git a/images/billing.png b/images/billing.png new file mode 100644 index 0000000..9c2c298 Binary files /dev/null and b/images/billing.png differ diff --git a/images/remediation-2.png b/images/remediation-2.png new file mode 100644 index 0000000..8a96d08 Binary files /dev/null and b/images/remediation-2.png differ diff --git a/images/remediation-pr.png b/images/remediation-pr.png new file mode 100644 index 0000000..00afaa3 Binary files /dev/null and b/images/remediation-pr.png differ diff --git a/platform/account-settings.mdx b/platform/account-settings.mdx index 08787d2..87d283c 100644 --- a/platform/account-settings.mdx +++ b/platform/account-settings.mdx @@ -3,8 +3,7 @@ title: "Account settings" description: "Manage your Hacktron profile and personal account security." --- -Use **Account settings** to manage your personal profile and your own Hacktron -account security. Open it from the account menu in the sidebar header. +Use **Account settings** to manage your personal profile and your own Hacktron account security. Open it from the account menu in the sidebar header. ## Profile @@ -16,9 +15,7 @@ Your profile controls how you appear to the rest of your organization. ## Multi-factor authentication (MFA) -Multi-factor authentication adds a second verification step to sign-in, so a -password alone is not enough to access your account. We strongly recommend -enabling MFA on every account. +Multi-factor authentication adds a second verification step to sign-in, so a password alone is not enough to access your account. We strongly recommend enabling MFA on every account. ### Enable MFA @@ -26,43 +23,31 @@ enabling MFA on every account. Open the account menu in the sidebar header and select **Account settings**. - Enable MFA from Account settings - + ![Enable MFA from Account settings](/images/mfa_enable.png) Select **Enable MFA**. Hacktron shows a QR code for your authenticator app. - Scan the QR code with an authenticator app such as 1Password, Google - Authenticator, or Authy. If you cannot scan it, enter the setup key manually. + Scan the QR code with an authenticator app such as 1Password, Google Authenticator, or Authy. If you cannot scan it, enter the setup key manually. - Enter the 6-digit code from your authenticator app to confirm setup. After it - is verified, MFA is required the next time you sign in. + Enter the 6-digit code from your authenticator app to confirm setup. After it is verified, MFA is required the next time you sign in. - - Organization-wide security controls are managed separately from personal - account settings. + + Organization-wide security controls are managed separately from personal account settings. ### Save your backup codes -When you enable MFA, Hacktron generates one-time backup codes. Store them in a -safe place such as a password manager. +When you enable MFA, Hacktron generates one-time backup codes. Store them in a safe place such as a password manager. - Backup codes are the only way to sign in if you lose access to your - authenticator app. Save them somewhere secure and do not share them. + Backup codes are the only way to sign in if you lose access to your authenticator app. Save them somewhere secure and do not share them. ### Disable or reset MFA -You can turn MFA off or re-run setup from **Account settings**. Disabling MFA -weakens your account security, so only do this if you are switching to a new -device or authenticator app. +You can turn MFA off or re-run setup from **Account settings**. Disabling MFA weakens your account security, so only do this if you are switching to a new device or authenticator app. \ No newline at end of file diff --git a/platform/automations/credits.mdx b/platform/automations/credits.mdx new file mode 100644 index 0000000..18a7cd9 --- /dev/null +++ b/platform/automations/credits.mdx @@ -0,0 +1,56 @@ +--- +title: "Automation credits" +description: "Understand how you buy automation credit, how each run deducts them, and how auto top-up keeps your balance stocked." +--- + +[Automations](/platform/automations/overview) run on shared organization automation credits. Every [remediation](/platform/automations/remediation) run, whether triggered manually from a finding or by an automation, deducts credits based on what the run costs when it completes. + +Automation credits are organization-wide. They are separate from Code Review seats and your Whitebox Scan credits. + +## How credits work + + + + + All organizations with an active [Code Review](/code-review/overview) subscription start with \$50 in automation credits. + + + Buy credits from **Billing** (access only for Organization Owners), and / or turn on [auto top-up](#auto-top-up) to keep the balance above a threshold you set. + + ![Billing](/images/billing.png) + + + + Complete any required card authentication (such as 3D Secure). The purchased credits are added to the organization balance after the charge succeeds. + + + A remediation run only starts while the organization has credits. When the balance runs out, new runs don't start and the Billing page shows that automations are paused. + + + Each run's cost is deducted from the balance once, when the run completes. Costs vary with the size of the run. + + + +## Auto top-up + +Auto top-up buys credits automatically when the balance drops below a threshold, so your automations keep running without manual purchases. + +Set it up on the Billing page under your automation credit balance: + +- **Trigger**: the balance that starts a top-up. +- **Target**: the balance the top-up buys back up to. Your target must be above the trigger. +- **Monthly limit**: an optional cap on how many credits auto top-up may buy per month. + +Auto top-up requires a saved payment method and charges the card on file without an interactive checkout. If a top-up charge fails, your automations stay paused until the balance is topped up manually or the card issue is resolved. + +## Related docs + + + + Trigger an AI-generated fix for a finding. + + + + Auto-remediate qualifying findings and notify your team. + + diff --git a/platform/automations/overview.mdx b/platform/automations/overview.mdx new file mode 100644 index 0000000..444e4b1 --- /dev/null +++ b/platform/automations/overview.mdx @@ -0,0 +1,77 @@ +--- +title: "Automations" +description: "Configure actions that run on triggers. Automate routine work such as remediation." +--- + +Automations act for you. Configure the rules that qualify a match, and when one comes in, Hacktron fires the automation: its **actions** run, and **notifiers** alert your team over Slack or email. + + + **Remediation** is the first available action. It starts a + [remediation](/platform/automations/remediation) run that fixes the finding, + and we'll expand automations with more actions over time. + + +Automations live under **Automations** in the dashboard sidebar. Organization **Admins** create and manage automations; other members can view them. + +## Create an automation + + + + On the **Automations** page, select **New automation** and give it a name. + + ![New automation](/images/autofix-1.png) + + + + Choose the repositories and [applications](/platform/context/applications) the automation covers. You can limit each entry to specific branches (up to two) or leave the branch selection empty to cover all branches. + + ![Pick environments](/images/autofix-2.png) + + + + On the **Settings** tab, set: + + - **Triggers**: when the automation runs, for example a PR scan finding, it's narrowed by the rules you set, the severity levels that qualify, and scope rules that limit it to specific repositories or applications. + - **Actions**: what the automation does. **Remediation** starts a [remediation](/platform/automations/remediation) run for the matching finding. + - **Notifiers**: who hears about a run, whether it's a Slack channel, email recipients from your organization's members, or both. + + ![Configure settings](/images/autofix-3.png) + + + + Select **Save**. An automation needs at least one environment, one trigger, and one action to run. Incomplete automations show an **Incomplete** badge and cannot be enabled. A save that removes required configuration disables the automation until it is complete again. + + + +## When an automation fires + +When a new finding matches an enabled automation's trigger, severity rules, scope rules, and environment (including any branch limits), the automation fires: a **Remediation** action starts a remediation run, which uses [automation credits](/platform/automations/credits). After taking action, we send you a notification. + +Each finding is fixed at most once, a finding that already has a remediation run won't fire automations again. + +### Notifications + +- **Slack**: Hacktron posts a message to your channel linking the finding. The Hacktron bot joins public channels automatically; for a private channel, invite the bot to the channel first. +- **Email**: Hacktron emails the recipients you choose from your organization's members. + +Notifications are best-effort, if one fails to send, it never blocks the remediation run itself. + +## Run history + +The **Run history** tab lists every run your automation has fired, with its status, the environment it matched, and the credits it used. Runs matched through an application are attributed to that application. + +Run statuses mirror [remediation outcomes](/platform/automations/remediation#outcomes): **Running**, **Success**, **No fix needed**, **False positive**, and **Failed**. You can filter the history by status and search it. + +![Run history](/images/automation-run-history.png) + +## Related docs + + + + How a remediation run works and where the fix lands. + + + + How runs are billed and how to keep a balance with auto top-up. + + diff --git a/platform/automations/remediation.mdx b/platform/automations/remediation.mdx new file mode 100644 index 0000000..338a825 --- /dev/null +++ b/platform/automations/remediation.mdx @@ -0,0 +1,68 @@ +--- +title: "Remediation" +description: "Trigger an AI-generated fix for a finding and receive it as a ready-to-review pull request." +--- + +Remediation is a part of [Automations](/platform/automations/overview) that fixes findings instead of just reporting them. A Hacktron agent analyzes the vulnerability, writes a fix, and opens a pull or merge request with the change. You review and merge it like any other PR. + + + When a remediation runs, Hacktron does the following: + + 1. **Verifies that the finding is real.** Tests whether the reported issue is actually exploitable in this code. If the finding is wrong (e.g. the code is unreachable), Hacktron reports it as a false positive. We will never attempt to fix already sound code. + 2. **Implements the fix.** Makes the minimal correct fix that addresses the root cause of the vulnerability. + 3. **Tests the fix.** Runs the existing test suite for the repository, if any. Adds relevant regression tests & makes sure the fix correctly addresses the issue while avoiding breaking anything else. + + +Remediation runs use [automation credits](/platform/automations/credits). You can start a run yourself from a finding or let it happen automatically through an [automation](/platform/automations/overview)'s Remediation action. + +## Remediate a finding + + + + Open the finding in the Hacktron dashboard, either in the finding detail panel or on the full finding page. + + + Select **Remediate**. Hacktron starts a remediation run for the finding. + + ![Remediate finding](/images/remediation-2.png) + + + When the agent produces a fix, Hacktron commits it to a dedicated fix branch and opens a pull or merge request in the finding's repository. Review and merge it as usual. + + ![Review the fix](/images/remediation-pr.png) + + + +Triggering remediation requires the **Member** role or above. Only one run happens per finding; if you select **Remediate** again while a run is active, Hacktron returns the existing run instead of starting a second one. + + + To push fix branches, Hacktron's GitHub App needs the **Contents: Read and write** permission. If your installation predates remediation, GitHub asks an organization admin to approve the updated permission before fixes can be pushed. + + +## Where the fix lands + +Hacktron picks the target branch for the fix automatically: + +- **Finding from an open PR or MR**: if the source pull or merge request is still open and its branch lives in the same repository, the fix is opened against that PR's branch, so the fix becomes part of the change that introduced the issue. +- **Everything else**: for merged or closed source PRs, branches from forks, and findings from whitebox scans, the fix is opened against the repository's default branch. + +If the source PR merges while the agent is still working, the fix is re-targeted to the default branch. + +## Outcomes + +A remediation run ends in one of four states: + +| Outcome | Meaning | +| --- | --- | +| **Success** | A fix was generated and a pull or merge request was opened. | +| **No fix needed** | The agent completed the run and concluded no code change is required. | +| **False positive** | The agent concluded the finding is not a real issue. | +| **Failed** | The run could not complete; the failure reason is recorded. | + +Runs triggered by an automation appear in that automation's [run history](/platform/automations/overview#run-history), including the credits each run consumed. + +## Run remediation automatically + + + Auto-remediate qualifying findings across repositories and applications, with Slack and email notifications. + diff --git a/platform/billing.mdx b/platform/billing.mdx new file mode 100644 index 0000000..0f3ab58 --- /dev/null +++ b/platform/billing.mdx @@ -0,0 +1,65 @@ +--- +title: "Billing" +description: "Trials, seats, and credits across the Hacktron Platform." +--- + +Hacktron bills each product separately. Code Review runs on seats, with a 14-day free trial. Whitebox Scans and Automations each run on their own credits, which are organization-wide and kept separate from each other. + +## How billing works + +| Product | Billed by | Pricing model | +| -------------------------------------------- | ------------------ | ------------- | +| [Code Review](/code-review/billing) | Developer seats | Subscription | +| [Whitebox Scans](/white-box-pentest/billing) | Scan credits | Usage-based | +| [Automations](/platform/automations/credits) | Automation credits | Usage-based | + +Organization owners manage billing. Other members cannot see the **Billing** page. + +## Code Review + +Code Review is billed by seat. Each developer with Code Review enabled counts as one seat. + +You are charged monthly (or annually -- [contact us](mailto:hello@hacktron.ai)) for the seats active during that billing period. Every organization starts with a 14-day free trial. + + + Learn more about Code Review billing. + + +## Whitebox Scans + +Whitebox Scans run on organization-wide scan credits. + +Calculate a scan's cost based on scope, and credits are deducted when the scan is started. + + + Learn more about Whitebox Scans billing. + + +## Automation Credits + +Automation credits are organization-wide. They are separate from your Whitebox Scan credits. + +Every paid organization starts with \$50 in Automation Credits. + + + Learn more about Automation Credits. + + +## Payment methods and Invoices + +Organization owners add and manage payment methods from **Billing**, where you can also view invoices and recent billing activity. diff --git a/platform/security-settings.mdx b/platform/security-settings.mdx index a2d830f..d6be82c 100644 --- a/platform/security-settings.mdx +++ b/platform/security-settings.mdx @@ -3,21 +3,15 @@ title: "Security settings" description: "Configure organization-wide MFA enforcement and SAML Enterprise SSO." --- -Use **Security settings** to manage authentication controls for your Hacktron -organization. These settings apply to members of the organization, not just your -own account. +Use **Security settings** to manage authentication controls for your Hacktron organization. These settings apply to members of the organization, not just your own account. - [Set up your own - MFA](/platform/account-settings#multi-factor-authentication-mfa) from - **Account settings**. + [Set up your own MFA](/platform/account-settings#multi-factor-authentication-mfa) from **Account settings**. ## Require MFA for members -Organization admins and owners can require MFA for every member of a Hacktron -organization. When this is enabled, members who have not set up MFA must complete -MFA setup before they can continue using that organization. +Organization admins and owners can require MFA for every member of a Hacktron organization. When this is enabled, members who have not set up MFA must complete MFA setup before they can continue using that organization. @@ -27,14 +21,12 @@ MFA setup before they can continue using that organization. In **Security**, locate **Require MFA for members**. - Enable **Require MFA for members**. Hacktron applies the requirement to the - current organization. + Enable **Require MFA for members**. Hacktron applies the requirement to the current organization. - Members who have not set up MFA are prompted to complete setup when they next - access the organization. + Members who have not set up MFA are prompted to complete setup when they next access the organization. ## Enterprise SSO @@ -42,8 +34,7 @@ MFA setup before they can continue using that organization. Hacktron supports Enterprise SSO through SAML. - If this is your first time setting up SAML SSO, you will need to [contact - us](mailto:hello@hacktron.ai). + If this is your first time setting up SAML SSO, you will need to [contact us](mailto:hello@hacktron.ai). If we have set up SSO for your organization, you can log in via SSO from your identity provider. @@ -53,15 +44,12 @@ If we have set up SSO for your organization, you can log in via SSO from your id From the login page, select **Single sign-on (SSO)**. - Enter the work email address for the domain connected to your SAML identity - provider. + Enter the work email address for the domain connected to your SAML identity provider. - Hacktron redirects you to the SAML identity provider configured for that - email domain. + Hacktron redirects you to the SAML identity provider configured for that email domain. - After successful authentication, you return to Hacktron and continue to the - page you were signing in for. + After successful authentication, you return to Hacktron and continue to the page you were signing in for. - + \ No newline at end of file diff --git a/white-box-pentest/billing.mdx b/white-box-pentest/billing.mdx index a379cce..0f6e06c 100644 --- a/white-box-pentest/billing.mdx +++ b/white-box-pentest/billing.mdx @@ -15,12 +15,12 @@ needs enough credits for that estimate. ## How credits work - - Hacktron estimates the credit cost from the selected repositories and scope. - Estimation does not deduct credits. + + Hacktron calculates the credit cost from the selected repositories and + scope. Cost calculation does not deduct credits. - Starting the scan deducts the estimated credits from the organization's + Starting the scan deducts the calculated credits from the organization's Whitebox Scan credit balance. Internal unlimited organizations show unlimited credits and are not charged. @@ -68,14 +68,13 @@ support before retrying the purchase. ## Insufficient credits -If the organization does not have enough credits for the estimate, the scan -will not start. +If the organization does not have enough credits, the scan cannot start. To continue: -1. Reduce the scope and run a new cost estimate. +1. Reduce the scope and run a new cost calculation. 2. Buy enough credits from **Billing**. -3. Start the scan again after the balance covers the estimate. +3. Start the scan again after the balance covers the calculation. API callers receive `402 Payment Required` when a scan cannot start because the organization has insufficient Whitebox Scan credits. @@ -92,10 +91,6 @@ If a started scan cannot launch successfully after credits are deducted, Hacktron attempts to refund those credits automatically. Failed and stopped scans can show refunded credits in the scan details and transaction history. -For Stripe purchase refunds, Hacktron applies the matching credit clawback to -the organization balance. If the refunded credits have already been spent, the -balance can become negative until the organization tops up again. - ## Related docs @@ -104,6 +99,7 @@ balance can become negative until the organization tops up again. icon="shield-halved" href="/api-reference/scans/create-scan" > - Start Whitebox Scans from the REST API and handle insufficient-credit errors. + Start Whitebox Scans from the REST API and handle insufficient-credit + errors.