Having trouble with the Orbis AppSec GitHub App? Email us at admin@orbisappsec.com and a human will reply within 1 business day.
Contact supportInstallation problems, unexpected scan results, missing pull requests, or anything that looks broken.
Email support →Found a security issue in Orbis AppSec itself? Report it privately and we will acknowledge it within 1 business day.
Report privately →Questions about your plan, invoices, your GitHub Marketplace subscription, or your account. A human replies to every message.
Contact a human →Every message goes to admin@orbisappsec.com, and we reply within 1 business day.
Including these details in your first email usually lets us resolve the issue without a round trip:
Please don't paste secrets, access tokens, or private source code into an email. If we need to look at code, we will tell you how to share it safely.
The issues customers hit most often, and how to resolve them yourself.
Install the app while you are signed in to the Orbis AppSec dashboard — the installation is linked to your account when GitHub redirects you back after setup. If the GitHub install page opened in a new tab, return to your original dashboard tab and refresh it so the installations list reloads. If it still doesn't appear, uninstall the app from GitHub (Settings → Applications) and install it again from the dashboard, then email us with your GitHub organization name.
Scans are triggered by pull request events — when a PR is opened, reopened, or updated with new commits. Pushing directly to a branch without an open pull request does not start a scan. Also confirm the repository is included in your installation: GitHub → Settings → Applications → Orbis AppSec → Configure, and check the selected repositories list.
That repository is not part of your GitHub App installation. Open GitHub → Settings → Applications → Orbis AppSec → Configure and either add the repository to the selected list, or switch the installation to all repositories. New repositories are not added automatically when the installation is limited to a specific set.
This is expected in several cases. If the repository is set to autonomy level L0, Orbis AppSec reports findings but never opens pull requests. Fixes are also skipped when the only affected files are lock files or documentation, and when the generated patch produces no net change against the base branch. Set the autonomy level to L1 to allow fix pull requests.
Commit a .orbis.yml file to the root of your repository with an autonomy_level key. L0 reports findings only, L1 (the default) opens fix pull requests for you to review, and L2 opens fix pull requests and auto-merges them. A .orbis.yml in your repository always takes precedence over the setting in the dashboard, so repository owners keep final control.
Yes. Orbis AppSec posts a "No vulnerabilities found" comment when a scan completes cleanly. Findings that cannot be shown to be reachable with attacker-controlled input are suppressed rather than reported, which is why results are typically much shorter than a rule-only scanner's output. If you believe a real issue was missed, email us the file and line and we will investigate.
A full analysis involves several scanners plus AI review and patch generation, so it can legitimately take from a few minutes up to around 30 minutes on a large repository. If a webhook delivery is missed, a fallback check retries within about 10 minutes. Reload the dashboard before reporting a problem — if a scan has shown no progress for over an hour, email us the pull request URL.
The API is rate limited per credential: 10 scan creations per minute, 30 finding requests per minute, 5 API key operations per minute, and 60 requests per minute for everything else. Respect the Retry-After response header and use the X-RateLimit-Remaining-Minute and X-RateLimit-Remaining-Hour headers to pace your requests. Email us if you need a higher limit for an integration.
Orbis AppSec deliberately stays quiet in some situations: when the comment comes from another bot, when it @-mentions someone other than Orbis AppSec, when it is a slash command aimed at a different tool, and when the pull request was not opened by Orbis AppSec. Leave a plain comment on an Orbis AppSec pull request and it will respond.
The FAQ answer "What languages and frameworks are supported?" carries the current coverage list — that page is the one we keep up to date, so check it there rather than relying on a second copy here. If a pull request touches only files outside that coverage, the scan completes without findings instead of reporting an error. Email us the repository and the language you need and we will tell you where it sits on the roadmap.
Scan results arrive as a pull request comment titled "Security Scan Results" that includes a security score and a summary of findings. Fix pull requests have titles beginning with "Fix:" and a description explaining the vulnerability and the change. All activity comes from the Orbis AppSec GitHub App bot account, never from a personal account.
Go to GitHub → Settings → Applications → Installed GitHub Apps → Orbis AppSec → Configure, then use Uninstall at the bottom of the page. For an organization, an owner performs the same steps from the organization settings. Access is revoked immediately and no action is required on our side. Email us if you also want your scan history deleted.
Still stuck? Email admin@orbisappsec.com and we will take it from there.
Data privacy, AI reliability, GitHub permissions, and how Orbis AppSec compares to traditional SAST tools.
Read the FAQ →Manage installations, review findings, re-run scans, and change the autonomy level for each repository.
Open dashboard →In-depth writeups of real vulnerability classes and the fixes for them, with vulnerable and secure code examples.
Read the blog →Email admin@orbisappsec.com with "Security report" in the subject line. Please include the affected component or URL, the steps needed to reproduce the issue, the impact you believe it has, and any proof of concept you have. We acknowledge every report within 1 business day and will keep you updated while we investigate and ship a fix.
Don't open a public GitHub issue or pull request for an unfixed vulnerability in Orbis AppSec — that discloses it to everyone before there is a fix. Give us a reasonable window to remediate before publishing, and we will credit you in the fix notes if you would like us to.
We will not pursue legal action against researchers who report issues in good faith, avoid privacy violations and service degradation, and only test against their own accounts and repositories. Please do not access, modify, or exfiltrate other customers' data while testing.
For anything to do with your plan, invoices, your GitHub Marketplace subscription, or your account, email admin@orbisappsec.com with "Billing question" in the subject line. A person reads and answers every one of these within 1 business day — there is no chatbot or ticket maze in front of us.
If you bought a plan through the GitHub Marketplace, upgrades, downgrades, and cancellations are managed from your GitHub billing settings, and your Marketplace receipts come from GitHub rather than from us. Tell us the GitHub account or organization the subscription belongs to and we can see your plan from our side.
Join thousands of developers who trust Orbis AppSec to find and fix vulnerabilities before they become problems. Get started in under 2 minutes.