Skip to main content
On GitHub and GitLab, you can talk to Vidoc in pull request (PR) comments. You can send scan commands, ask questions about the code, and ask Vidoc to remember a fact.
Commands and questions are not available on Bitbucket. Vidoc does not read PR comments on Bitbucket. To scan again, push a new commit. To change a finding, use the web app.

​
The Vidoc handle

To talk to Vidoc, mention its handle at the start of your comment. The handle depends on the platform: The summary comment of Vidoc always shows the correct handle in its last line: “Have questions? Tag @… in a comment”. Use this handle. This page uses @vidoc in the examples.

​
Scan commands

Write a new PR comment or thread reply that starts with the handle and contains only the command. How Vidoc reads a comment that mentions the handle: Rules for commands:
  • Letter case is not important. A period or exclamation mark at the end is permitted.
  • Put only the command on one line. Do not put it in a quote or a code block.
  • If you edit a comment, Vidoc does not run the command in it. Write a new comment.
  • PR reviews and PR comments must be on for the repository.
  • You do not need a Vidoc account to send commands.

​
Who can send commands

​
Cooldown

Vidoc starts a new scan from a command only if no other scan of this PR started in the last 60 seconds. If a scan started recently, wait one minute and send the command again.

​
Replies from Vidoc

When Vidoc accepts the command, it adds the “eyes” (👀) reaction to your comment. Then Vidoc replies in the thread: On GitHub, you can also select Run Vidoc on the Vidoc Security Scan check to scan again. This button shows only when status reporting is on. Refer to Status check.

​
Ask Vidoc a question

You can ask Vidoc a question in a PR comment or in a thread. Mention the handle and write your question:
Vidoc adds the “eyes” (👀) reaction to your comment. Then Vidoc replies in the same thread. To answer, Vidoc reads the repository code and the thread history. Vidoc does not change your code. The first Vidoc answer on a PR includes this text: “You’re chatting with an AI system. Responses may be inaccurate.” A comment that contains only a command is a command, not a question.

​
What Vidoc can do when you mention it

  • Read the code of the repositories in the Vidoc project, and read Memory.
  • List the findings and the reviewed PRs of the Vidoc project.
  • Save a memory entry.
  • Change the status or the severity of a finding in the Vidoc project, when you ask for it explicitly.
A status change through a question does not create a learning. To give feedback on one finding, reply in its thread. Refer to Feedback.

​
Ask Vidoc to remember a fact

You can ask Vidoc to remember a general fact about your code:
Vidoc saves the fact as a memory entry. The validation agent uses it in later scans. The entry can apply to all repositories of the Vidoc project, not only to your repository. Vidoc selects the scope from the text of your request. Your AppSec team can see and supersede memory entries on the Memory page.

​
Who can ask questions and “remember” requests

The permissions above allow project-wide access through the bot: the requester can ask about code and findings from other repositories in the same Vidoc project, change finding status or severity, and save project or repository memory. These actions do not use the web app’s role restrictions. On GitLab, this includes eligible developers who have no Vidoc account.Group repositories in a Vidoc project only when these users are authorized for that access. Review status changes on Findings and new Memory entries regularly. Organization-wide memory cannot be saved from a PR mention.