What it does
The site says HackerOne PullRequest is now HackerOne Code. The service combines AI with expert human review to give developers remediation guidance on security problems in their code before it reaches production. HackerOne's AI, called Hai, identifies high-risk code changes and filters out low-risk issues. Expert engineers then manually review and validate each finding before it is shown to developers, an approach the site calls human-in-the-loop and says almost eliminates false positives. Developers also pick up security practices from the reviewers' feedback. It integrates with GitHub, GitLab, Bitbucket and Azure DevOps and supports all major programming languages and frameworks. A separate Code Security Audit offers human-led audits of a codebase. The site says reviewers are contractors in the US, UK, New Zealand, Australia or Canada who pass criminal background checks, and that enterprise customers can keep their code on their own network and hardware. The site has a pricing page and a demo form, but the home page shows no prices.
Capabilities
- AI triage of high-risk code changes followed by expert human validation
- Remediation guidance delivered inside tools developers already use
- Works with GitHub, GitLab, Bitbucket and Azure DevOps
- Human-led code security audits
- Option for enterprises to keep code on their own network
When to use it
- You want security-focused review of pull requests that goes beyond automated scanning
- You want fewer false positives reaching your developers
- You want a human-led security audit of a codebase
