Question 1

How is Code Audit different from a SAST scanner?

Accepted Answer

Static scanners flag patterns like a tainted parameter, a risky API call, a missing check. AI Code Audit reasons about intent across your codebase to identify issues that need an attacker's perspective: IDORs, broken access control, multi-step exploit chains, and business logic flaws. It complements SAST rather than replacing it.

Question 2

Why doesn't AI Code Audit need a live URL?

Accepted Answer

It reads and reasons about your source code directly. There's no crawl phase, no traffic replay, and no live exploitation, so there's no environment to point at. For live testing against a deployed target, use Aikido Pentest instead.

Question 3

What apps and languages are covered?

Accepted Answer

Supports ALL languages; no limitations whatsoever. Code Audit isn't limited to web apps. Agents reason across whatever source the connected repositories contain, including mobile apps, smart contracts, and desktop apps, across mainstream languages, configuration, and IaC. Monorepos with multiple services are fully supported.

Question 4

Why is there a repo limit?

Accepted Answer

Code Audit focuses agent attention on a coherent set of codebases. Beyond a certain number of repositories, analysis tends to lose focus and quality drops. Contact support if you genuinely need more in a single audit.

Question 5

When should I pick AI Code Audit and when should I pick AI Pentest?

Accepted Answer

Both products run on a similar agentic engine but answer different questions. Code Audit reasons about your source code; Aikido Pentest validates it on your running application. Use AI Code Audit when you want deep code reasoning on logic and architectural flaws (IDORs, broken access control, multi-step chains) without configuring a live environment, when you don't have a stable staging or QA target, when you need a fast turnaround with minimal setup, or when you have a difficult-to-test-live codebase like mobile apps, desktop apps, or smart contracts. Use Aikido Pentest when you have a live target and want to validate real exploitability with real traffic, when you want runtime evidence, when your scope includes domains and authenticated user roles, or when you need a live penetration test to comply with SOC 2, ISO 27001, or similar frameworks.

Question 6

How do I get started?

Accepted Answer

Code Audit is in the sidebar menu in the Attack section. Connect a repository to start an audit in about five minutes.

Question 7

How much does Code Audit cost?

Accepted Answer

Paid in Aikido credits. The Pricing step in the create flow shows the exact credit total before you commit. Cost depends on repo size and complexity.