Run and Act on a Security Audit

This walks through a full pass through Orbit’s Security surface: run an audit, read the results, decide what to do with a finding, review and approve a fix, work a multi-finding fix plan, and set up a recurring check.

Run an audit

Open Security from the titlebar workspace switcher.
Click Audit my codebase.
Select one or more registered projects.
Choose a profile:
- Quick checks — deterministic scanners against your working tree; no account needed, no model spend.
- Deep audit — adds model-backed code review on top of the deterministic checks. Requires a ready provider account or credits; only appears enabled once one is configured.
- History scan — runs the deterministic checks against your Git history, bounded to the 50 most recent commits.
Review the confirmation screen. For a Deep audit, Orbit shows exactly what it’s about to do: redacted source, bounded to a limited file count, sent to the selected provider — read this before continuing, since it uses your account.
Click Run it. You can cancel from the running screen at any point; a cancelled run is recorded as cancelled, never as a clean pass.

Read the results

When the audit finishes, Security leads with the single most important open finding, then lists the rest ranked by severity, with a “smaller items” section collapsed by default. Open What Orbit checked to see the coverage breakdown — what was scanned, what didn’t apply, and where a check couldn’t run at all. If any coverage gaps exist, Security says so explicitly rather than implying a clean bill of health.

Triage a finding

Click a finding to open its detail. From there:

Fix this starts a fix preview (see below).
Not a problem, Accept risk, or Later set the finding aside — each requires a short written reason, and “Later” needs a return date. If the finding is eligible, “Not a problem” also offers an optional checkbox to suppress future matches in that same file, project, and rule; nothing is suppressed unless you check it.
I’ve fixed it marks the finding as fixed pending an independent re-scan — it doesn’t close the finding on your word alone.
Verify with a fresh scan re-runs a targeted check against the finding’s original scope to confirm the condition is actually gone.
For a secret finding, Confirm rotation records that you revoked or rotated the credential with its provider — a separate step from fixing the code that exposed it.

Set-aside findings aren’t gone; find them again under Manage → Set aside, where Put back restores one to active review.

Preview and approve a fix

From a finding, click Fix this (or Preview a fix).
Security shows the exact before/after diff it proposes, scoped to one file, along with what Orbit will do automatically versus what only you can do (like rotating a credential).
Click Approve this change. This is a final, explicit approval step against the specific preview you just reviewed — if the source has drifted or the preview is stale, approval fails and you’ll need a fresh preview instead.
Once the change ships, use Verify with a fresh scan to confirm it actually resolved the finding.

There’s no bulk approval anywhere in Security: every fix, and every campaign step, is approved one at a time.

Build and run a fix plan

When an audit returns more than one priority finding, Security offers to draft a fix plan — a sequenced set of steps, secrets and shared fixes first.

From the results screen, click let Orbit draft a plan.
Review the plan’s phases and steps.
Click Start plan to turn it into a running campaign.
Work through each step: Prepare preview → review the diff → Approve this step. Rotation steps stay blocked until the code step ahead of them is verified.
Verify this step once a step’s change has shipped.
Use Export report at any point to get a portable Markdown copy of the plan, including any coverage gaps and rotation notes.

You can pause a running campaign and resume it later; each step keeps its own individual approval regardless.

Schedule weekly audits

Go to Manage.
Under Check automatically every week, toggle the schedule on.
Choose the projects and a deterministic profile — standard or history. Security refuses to schedule a Deep audit, since a recurring model review would spend account credits without a per-run approval.
Each scheduled run compares against the one before. If the schedule’s projects or scanner scope later change, the schedule pauses rather than silently comparing against an older, no-longer-matching baseline — start a fresh audit and recreate the schedule when that happens.