> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Commands and questions
> Mention Vidoc in a pull request comment to start a scan, ask a question, or save a fact to Memory.
On GitHub and GitLab, you can talk to Vidoc in pull request (PR) comments. You can send scan commands, ask questions about the code, and ask Vidoc to remember a fact.
Commands and questions are not available on Bitbucket. Vidoc does not read PR comments on Bitbucket. To scan again, push a new commit. To change a finding, use the [web app](/web-app/findings).
## The Vidoc handle
To talk to Vidoc, mention its handle at the start of your comment. The handle depends on the platform:
| Platform | Handle |
| -------- | ----------------------------------------------------------------------------------------------------------------------- |
| GitHub | `@vidoc` on Vidoc Cloud. On a self-hosted installation, your administrators set the handle. The default is `@vidoc`. |
| GitLab | The GitLab username of the Vidoc bot user, for example `@vidoc-bot`. Your GitLab administrators selected this username. |
The summary comment of Vidoc always shows the correct handle in its last line: "Have questions? Tag @... in a comment". Use this handle. This page uses `@vidoc` in the examples.
## Scan commands
Write a new PR comment or thread reply that starts with the handle and contains only the command.
| Command | Result |
| ---------------- | --------------------------------------------------------------------- |
| `@vidoc` | Scan the current head commit. |
| `@vidoc scan` | Scan the current head commit. |
| `@vidoc rescan` | Scan the current head commit. |
| `@vidoc rerun` | Scan the current head commit. |
| `@vidoc restart` | Stop the active scan and start a new scan of the current head commit. |
| `@vidoc help` | Show the list of commands. |
How Vidoc reads a comment that mentions the handle:
| Comment | Vidoc reads it as |
| ----------------------------------------------------------------------- | -------------------------------------------------------- |
| `@vidoc` alone | A scan command |
| `@vidoc` and one command word from the table | That command |
| `@vidoc`, a command word, and more words, for example `@vidoc scan now` | A wrong command. Vidoc replies with the help text. |
| `@vidoc` and other text, for example `@vidoc Is this input validated?` | A question. Refer to [Questions](#ask-vidoc-a-question). |
Rules for commands:
* Letter case is not important. A period or exclamation mark at the end is permitted.
* Put only the command on one line. Do not put it in a quote or a code block.
* If you edit a comment, Vidoc does not run the command in it. Write a new comment.
* **PR reviews** and **PR comments** must be on for the repository.
* You do not need a Vidoc account to send commands.
### Who can send commands
| Platform | Permission |
| -------- | ----------------------------------------------------------------------------------------- |
| GitHub | The write, maintain, or admin permission on the repository. |
| GitLab | The **Developer** role or higher on the project. Your GitLab account must not be blocked. |
### Cooldown
Vidoc starts a new scan from a command only if no other scan of this PR started in the last 60 seconds. If a scan started recently, wait one minute and send the command again.
### Replies from Vidoc
When Vidoc accepts the command, it adds the "eyes" (👀) reaction to your comment. Then Vidoc replies in the thread:
| Reply | Meaning |
| ----------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| "Vidoc queued a scan for commit ... The PR summary will show its progress." | A new scan starts. |
| "Vidoc already has a scan queued or running for commit ..." | A scan of this commit already runs. Use `restart` to replace it. |
| "A scan started recently. Wait one minute before you start another scan for this pull request." | Wait one minute, then send the command again. |
| "Repository write access is required to request a Vidoc scan." | You do not have the necessary permission. |
| "Only open pull requests can be scanned." | The PR is closed or merged. |
On GitHub, you can also select **Run Vidoc** on the **Vidoc Security Scan** check to scan again. This button shows only when status reporting is on. Refer to [Status check](/pull-requests/overview#status-check).
## Ask Vidoc a question
You can ask Vidoc a question in a PR comment or in a thread. Mention the handle and write your question:
```text theme={null}
@vidoc Is the token in this handler checked before the database call?
```
Vidoc adds the "eyes" (👀) reaction to your comment. Then Vidoc replies in the same thread. To answer, Vidoc reads the repository code and the thread history. Vidoc does not change your code.
The first Vidoc answer on a PR includes this text: "You're chatting with an AI system. Responses may be inaccurate."
A comment that contains only a command is a command, not a question.
### What Vidoc can do when you mention it
* Read the code of the repositories in the Vidoc project, and read Memory.
* List the findings and the reviewed PRs of the Vidoc project.
* Save a memory entry.
* Change the status or the severity of a finding in the Vidoc project, when you ask for it explicitly.
A status change through a question does not create a learning. To give feedback on one finding, reply in its thread. Refer to [Feedback](/pull-requests/feedback).
## Ask Vidoc to remember a fact
You can ask Vidoc to remember a general fact about your code:
```text theme={null}
@vidoc Remember that all endpoints under /internal are reachable only from the admin VPN.
```
Vidoc saves the fact as a memory entry. The validation agent uses it in later scans. The entry can apply to all repositories of the Vidoc project, not only to your repository. Vidoc selects the scope from the text of your request.
Your AppSec team can see and supersede memory entries on the [Memory](/web-app/memory) page.
## Who can ask questions and "remember" requests
| Platform | Permission |
| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| GitHub | Your GitHub account must be linked to a Vidoc user with access to the Vidoc project. The Vidoc role is not important. If Vidoc cannot match your account, Vidoc does not reply. Refer to [Link your account](/pull-requests/feedback#link-your-account). |
| GitLab | The **Developer** role or higher on the GitLab project. You do not need a Vidoc account. If you do not have the role, Vidoc does not reply. |
| Bitbucket | Not supported. |
The permissions above allow project-wide access through the bot: the requester can ask about code and findings from other repositories in the same Vidoc project, change finding status or severity, and save project or repository memory. These actions do not use the web app's role restrictions. On GitLab, this includes eligible developers who have no Vidoc account.
Group repositories in a Vidoc project only when these users are authorized for that access. Review status changes on [Findings](/web-app/findings) and new [Memory](/web-app/memory) entries regularly. Organization-wide memory cannot be saved from a PR mention.