Importing code

Open Projects → New project. There are three sources:

For every project you choose the frameworks to check (DPDP, GDPR, SOC 2, HIPAA, PCI DSS, ISO 27001, CCPA, LGPD) and, for repositories, the branch to scan — the default branch unless you pick another.

1. 1

   Install the app

   A workspace owner or admin clicks Connect GitHub (under Integrations or on the import screen). GitHub asks which account and which repositories RuleFix may read — all, or only the ones you select.

2. 2

   Authorise and come back

   GitHub asks you to authorise RuleFix once, then returns you to the dashboard. If an organisation owner must approve the install first, the dashboard shows the request as pending until they do.

3. 3

   Pick repositories

   Back on New project, choose the account, pick a repository, set frameworks and the branch, and import. The first scan starts right away. You can connect several GitHub accounts and organisations to one workspace.

Permissions

The app asks for Contents: read-only and Metadata: read-only on the repositories you choose — nothing else. It can't push code, open pull requests or read organisation data. Change the selected repositories or uninstall at any time in your GitHub settings; disconnecting in RuleFix removes the link from your workspace.

How ownership is verified

An installation is linked to your workspace only when all of these hold:

• the install started from your browser in this workspace (a signed, expiring state that must match a cookie set when you clicked Connect);
• you are still an owner or admin of that workspace;
• GitHub confirms, with a one-time authorisation of your GitHub account, that you can access that installation. The token is used for this single check and revoked immediately; it is never stored.

So nobody can attach someone else's GitHub installation to their workspace by editing a URL.

Paste the repository URL. Only these forms are accepted (the scheme, a trailing slash and .git are optional):

• https://github.com/owner/repo
• https://gitlab.com/group/subgroup/project
• https://bitbucket.org/workspace/repo

Links to a branch or file (/tree/main, /blob/…), other hosts and self-hosted instances are rejected. The repository must be public; private repositories need the GitHub App. Public imports use the providers' anonymous APIs, which are rate-limited — if a provider is busy, RuleFix tells you to try again in a few minutes.

Every repository project has a Scan now button. A scan reads the branch at its latest commit on RuleFix's servers, runs the project's frameworks through the rule engine, and records findings as issues. File contents are held in memory only for the duration of the scan.

• Each project can be scanned once a minute, and only one scan of a project runs at a time.
• The scan result shows files scanned, new issues and issues closed automatically.
• Scans run when you click — there are no scheduled scans or push webhooks yet (see what isn't available).

RuleFix skips vendored, generated and tooling directories (node_modules, vendor, dist, build, .next, coverage, virtualenvs…), lockfiles, minified bundles, type declarations, binary files, symlinks and submodules.

When a repository has more than 400 eligible files, application code wins over tests, fixtures, examples and docs, then shallower paths, then alphabetical order — so the same files are picked on every scan.

A scan is complete only if every eligible file on the branch was read. It is partial when anything was left out: the 400-file cap, files over 512 KiB, a truncated file tree, the time budget, or files that failed to download.

The score shown for each scan uses the same formula as everywhere else; see how the score is calculated.