How to use Spartyx.

What Spartyx is

Spartyx is a security scanner. You point it at your code (or a live website) and it reports the security problems it finds — hardcoded secrets, SQL injection, command injection, vulnerable dependencies, misconfigurations, and more — along with plain-language explanations and how to fix each one.

It works in three levels of depth so you only pay for the intelligence you need: a fast deterministic pass, an intelligence pass that cross-references real-world vulnerability databases, and a deep AI review. You can scan a GitHub repository, a public repo URL, an uploaded folder, a pasted snippet, or a live website.

Getting started

1. 1
   Sign in

   Click Sign in in the top-right and authenticate. New here? Join the beta from the landing page first.
2. 2
   Register this device

   The first time you open the dashboard, Spartyx asks you to register your browser as a trusted device. Open the Overview tab (or the Scan workspace) and click Register this device. This is a one-time security step — scans stay locked until it's done.
3. 3
   Open the Scan workspace

   From the left sidebar choose Scan workspace. This is where every scan begins.

The three scan modes

Before starting a scan you pick a Review depth. Each one builds on the previous:

Running a code scan

In the Scan workspace you choose a target (step 1), a review depth (step 2), confirm consent and retention (step 3), then start (step 4). There are four ways to give Spartyx a target:

1. 1
   Pick a target

   Choose one of the four options above.
2. 2
   Choose review depth

   Baseline, Intelligence, or Deep Review.
3. 3
   Review retention & consent

   Decide whether Spartyx keeps your source after the scan (for audit/admin review) and, for uploads, approve the upload consent checkbox.
4. 4
   Start scan

   Click Start scan. Progress shows live in the panel; large repositories run as a background job you can track.

Website surface scan

The Website surfacetab checks a live site from the outside: security headers, cookie flags, redirects, technology fingerprinting, and exposed sensitive files. Passive checks (headers, metadata) need only a URL. Deeper "active" or "red team" testing requires you to fill in a written authorization with scope and approval evidence first — that's a safeguard so nobody scans a site they aren't allowed to.

Reading your results

When a scan finishes you get a prioritized triage list. Each finding shows:

• •Severity — Critical, High, Medium, or Low. Start at the top.
• •What & where — the vulnerability type, the file, and the exact line.
• •Evidence — the specific code that triggered it.
• •Reachability — whether the risky code is actually reachable from user input (confirmed, guarded, or unproven), so you can tell real risk from noise.
• •Remediation — how to fix it. In Deep Review, an AI explanation of the attack technique is included.

Dependency findings additionally show the CVE/GHSA identifiers, the fixed version to upgrade to, and links to the official advisories.

Attack chains

A single finding tells you what's wrong in one spot. An attack chainshows how an attacker would string several findings together into one multi-step path — for example, a route missing an authentication check that then reaches a SQL injection is one "unauthenticated database breach" story, not two unrelated rows.

Open the Attack Path tab to see them. Each chain is laid out in stages — Entry → Propagation → Impact — with a plain-language narrative and a risk score. Expand a chain to walk through every step, file, and line. Chains only appear when two or more related findings actually connect, so they highlight your most dangerous, realistic exposures.

Fixing issues

The Fix queuetab tracks remediation. For findings in a connected GitHub repository, Spartyx can generate a remediation pull request for you — a proposed code patch you review and merge on GitHub. You can also set a finding's status (open, in progress, resolved, false positive) and assign it, so a team can work through the queue together.

Reports & exports

From the results panel you can export your findings in three formats:

GitHub Code Scanning

When you scan a repository through the GitHub App, Spartyx automatically pushes the findings into GitHub's own Security tab and as pull-request annotations — so they show up right where your team already works, no manual upload needed.

Troubleshooting & FAQ