How to use Spartyx.

What Spartyx is

Spartyx is a security scanner. You point it at your code (or a live website) and it reports the security problems it finds — hardcoded secrets, SQL injection, command injection, vulnerable dependencies, misconfigurations, and more — along with plain-language explanations and how to fix each one.

It works in three levels of depth so you only pay for the intelligence you need: a fast deterministic pass, an intelligence pass that cross-references real-world vulnerability databases, and a deep AI review. You can scan a GitHub repository, a public repo URL, an uploaded folder, a pasted snippet, or a live website.

Getting started

1. 1
   Sign in

   Click Sign in in the top-right and authenticate. New here? Join the beta from the landing page first.
2. 2
   Register this device

   The first time you open the dashboard, Spartyx asks you to register your browser as a trusted device. Open the Overview tab (or the Scan workspace) and click Register this device. This is a one-time security step — scans stay locked until it's done.
3. 3
   Open the Scan workspace

   From the left sidebar choose Scan workspace. This is where every scan begins.

The three scan modes

Before starting a scan you pick a Review depth. Each one builds on the previous:

Running a code scan

In the Scan workspace you choose a target (step 1), a review depth (step 2), confirm consent and retention (step 3), then start (step 4). There are four ways to give Spartyx a target:

1. 1
   Pick a target

   Choose one of the four options above.
2. 2
   Choose review depth

   Baseline, Intelligence, or Deep Review.
3. 3
   Review retention & consent

   Decide whether Spartyx keeps your source after the scan (for audit/admin review) and, for uploads, approve the upload consent checkbox.
4. 4
   Start scan

   Click Start scan. Progress shows live in the panel; large repositories run as a background job you can track.

Website surface scan

The Website surface tab checks a live site from the outside: security headers, cookie flags, redirects, technology fingerprinting, and exposed sensitive files. Passive checks (headers, metadata) need only a URL. Deeper "active" or "red team" testing requires you to fill in a written authorization with scope and approval evidence first — that's a safeguard so nobody scans a site they aren't allowed to.

Reading your results

When a scan finishes you get a prioritized triage list. Each finding shows:

• •Severity — Critical, High, Medium, or Low. Start at the top.
• •What & where — the vulnerability type, the file, and the exact line.
• •Evidence — the specific code that triggered it.
• •Reachability — whether the risky code is actually reachable from user input (confirmed, guarded, or unproven), so you can tell real risk from noise.
• •Remediation — how to fix it. In Deep Review, an AI explanation of the attack technique is included.

Dependency findings additionally show the CVE/GHSA identifiers, the fixed version to upgrade to, and links to the official advisories.

Attack chains

A single finding tells you what's wrong in one spot. An attack chain shows how an attacker would string several findings together into one multi-step path — for example, a route missing an authentication check that then reaches a SQL injection is one "unauthenticated database breach" story, not two unrelated rows.

Open the Attack Path tab to see them. Each chain is laid out in stages — Entry → Propagation → Impact — with a plain-language narrative and a risk score. Expand a chain to walk through every step, file, and line. Chains only appear when two or more related findings actually connect, so they highlight your most dangerous, realistic exposures.

Fixing issues

The Fix queue tab tracks remediation. For findings in a connected GitHub repository, Spartyx can generate a remediation pull request for you — a proposed code patch you review and merge on GitHub. You can also set a finding's status (open, in progress, resolved, false positive) and assign it, so a team can work through the queue together.

Reports & exports

From the results panel you can export your findings in three formats:

GitHub Code Scanning

When you scan a repository through the GitHub App, Spartyx automatically pushes the findings into GitHub's own Security tab and as pull-request annotations — so they show up right where your team already works, no manual upload needed.

Scanning from CI

A build pipeline has no browser to sign in with, so it authenticates with an API key instead. Create one under Settings → API keys in your dashboard. The key is shown once — we store a hash of it, not the key itself, so it cannot be shown again. Treat it like a password.

1. 1
   Create the key

   Dashboard → Settings → API keys → Create key. Name it after whatever will use it, so a list of keys stays readable later.
2. 2
   Store it as a repository secret

   In GitHub: Settings → Secrets and variables → Actions → New repository secret, named SPARTYX_API_KEY. Never paste a key into a workflow file — that commits it to your history.
3. 3
   Add the workflow

   Commit the file below as .github/workflows/security.yml. There is no checkout step, because the scan reads your repository through the API rather than from the runner's disk.

name: Security

on:
  pull_request:

permissions:
  contents: read          # read the repository to scan it
  pull-requests: write    # write the summary comment

jobs:
  spartyx:
    runs-on: ubuntu-latest
    steps:
      - uses: waleed-khan13/spartyx-action@v1
        with:
          api-key: ${{ secrets.SPARTYX_API_KEY }}
          fail-on: none   # report first; gate once you have looked

Open a pull request and a comment appears when the scan finishes. Every later push edits that same comment rather than adding another, so the thread stays readable.

The mode input takes the internal name for each review depth rather than the label used elsewhere in the product:

Every input, more workflow recipes, and how to send findings to GitHub's Security tab are documented at github.com/waleed-khan13/spartyx-action.

Troubleshooting & FAQ