> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Point a security agent at your codebase for gray-box exploit-path discovery with repro steps.

# Repositories

A repository Red Team run points a security agent at your codebase. The agent clones the repo into an isolated sandbox, chains findings together the way an attacker builds a kill chain, and records exploit paths with repro steps in the red-team report. Because the run uses the full repo as context, this is the gray-box option: it sees your code, not just your public surface.

### Start a repository run

1. Open **Red team** and select **New report**, or go to `/app/reports/new`.
2. Choose **Repository**.
3. Select one or more repositories from the repos where Superagent Security is installed.
4. Optionally add a goal prompt to focus the engagement, then submit.

Private repositories require the security app with repository contents access. Beyond manual creation, repository runs can trigger automatically on a GitHub release, a tag, or a schedule.

### Configure recurring runs

1. Open **Repository** and select a connected repository.
2. Enable **Red teaming** in its settings.
3. Choose releases, prereleases, release tags, or a daily, weekly, or monthly
   schedule.
4. Add a repository-specific goal when the campaign needs a narrower scope.
5. Select **New run** once to confirm repository access and the goal before
   relying on the trigger.

### The report detail page

Repository red-team reports open at `/app/reports/repository/[id]`. The detail view includes:

- Run status and the live agent event feed
- Linked **findings** discovered during the run, each with repro context
- Assignees and status updates for your team's review workflow
- Cost and timing for the engagement

### Findings

Discovered issues land in the [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue as `repository_red_team` findings. From there you can run automated triage to verify exploitability and turn confirmed issues into fix PRs.

### Relationship to PR scans

Repository Red Team uses the same GitHub App installation as [PR Security](https://www.superagent.sh/docs/security-workers/pr-security). PR scans check every pull request before merge; Red Team runs are deeper engagements you start on demand or on a trigger.

## Next steps

- [Review findings and reports](https://www.superagent.sh/docs/concepts/findings-and-reports)
- [Add continuous PR Security](https://www.superagent.sh/docs/security-workers/pr-security)
- [Automate remediation with Cursor](https://www.superagent.sh/docs/use-cases/continuous-adversarial-testing-with-cursor)

---
Source: https://www.superagent.sh/docs/security-workers/red-team/repositories
Index: https://www.superagent.sh/llms.txt