Daybreak Defense Factory scans code in a connected GitHub repository and shares the findings with your team. Start with one repository or folder. Once you’ve reviewed the results, you can monitor new commits or set a schedule.
Open Daybreak and connect GitHub
- Open Plugins on the web or in the desktop app using a ChatGPT workspace with access to Daybreak. Search for Daybreak Defense Factory (Preview), then install and enable it.
- Open Daybreak in the sidebar. On the welcome screen, select Run an agentic scan.
- If prompted, select Connect GitHub and sign in with an account that can access the repository.
Cloud scans run in Codex cloud. Each person who starts a scan needs a personal GitHub connection. Daybreak Defense Factory doesn’t support workspace connections. If the repository doesn’t appear, check which repositories the GitHub app can access under Configure access. Ask your GitHub administrator to add the repository if needed.
Run your first scan
- On Configure your scan, select a repository.
- Choose Full repository to scan the default branch, or Specific folder or files to narrow the scan. Enter one path per line, relative to the repository root. For example, enter
src/to scan only the application code in that folder. - Select Start Scan. When First scan queued appears, select View scan. Check the repository and paths in the scan record. You can return to it from Scans.
When the scan finishes, open a finding to see the affected code and how an attacker could reach it. If the scan failed or stopped early, check what it covered before interpreting the results. See Review findings and fixes.
Choose how to scan a repository
From New scan, choose Cloud, select the repository, and check the cloud environment that Daybreak will use.
| Scan method | When to use it |
|---|---|
| Repository scan | Check the current code once. Use this to look for existing issues, including bugs that span several commits. |
| Continuous monitoring | Check new commits on the default branch. Choose how far back to start if you also want to review recent history. |
| Scheduled scan | Repeat a repository scan on a schedule. Use this for a regular review of the default branch. |
You can change or pause monitoring in Continuous scanning settings. Open Repositories and select the repository to find these settings. The owner, people with edit access, and Daybreak Defense Factory administrators can change these settings for the whole team. You can also edit the repository’s threat model to update the context for future scans.
You can enable pull request reviews to check changes before they merge. Workspace notifications let you send scan events to a service you control.
Scan your local checkout
In the desktop app, select New scan, then Local. Choose Codebase to scan the checkout or Changes to review uncommitted work. For a codebase scan, you can limit the scope to one folder. Turn on Deep scan if you want multiple passes and can spend more time and tokens.
Local findings appear in Overview on this device. A local scan can send relevant code and prompts to the configured model provider. Local scans with Daybreak Blue require trusted access. If you see Apply for Daybreak, use it to request access.