Documentation

DebtDrone supports three ways to sign in: standard email and password, one-click Google OAuth, or GitHub OAuth. All three work for both signing up and logging back in.

Account Workflows

• Email Verification: If registering with email/password, your password must include an uppercase letter, a lowercase letter, a number, and a special character (8+ characters total). After registering, we email a 6-digit verification code — it expires after 10 minutes, and you get 5 attempts to enter it correctly before needing to restart signup.
• Password Security: Passwords are securely hashed, never stored in plain text. If you lose access, the "Forgot Password" flow emails a secure, time-limited reset link (valid for 1 hour). Resetting your password automatically signs you out of every other active session for security.
• Profile Management: Inside the Dashboard, navigate to Profile to update your display name, avatar, and account details.
• Impersonation (Admins only): System administrators have the ability to securely impersonate users for troubleshooting. When active, an unmistakable yellow banner is displayed across the screen to indicate the impersonated state.

Getting a repository fully scanning takes two steps: connecting it to DebtDrone, and installing the DebtDrone GitHub App.

1. Connect your repositories

In Settings → Integrations, connect your GitHub account via OAuth and select which repositories you want DebtDrone to track. You can re-sync at any time to pick up newly created repositories.

2. Install the GitHub App

Connecting a repository lets DebtDrone see it, but the GitHub App itself must also be installed on your account or organization for scans to run automatically and for pull request comments to appear. If it isn't installed yet, you'll see an "Install on GitHub" button on your Dashboard — click it to be taken straight to GitHub's install page. Once installed, the button disappears automatically.

After connecting your repositories, they appear in the Repositories table. Each repository displays its last scan status, active issues count, and historical debt score.

The Scanning Lifecycle

1. Triggering: Click the Trigger Scan button, or open a pull request on a repository with the GitHub App installed — either way, a job is queued for processing.
2. Queued: The UI will update to indicate the repository is "Pending".
3. Processing: A background worker picks up the job, fetches the codebase, and begins passing files through the complexity engine and security scanner (Trivy). Depending on the size of your monorepo, a scan can take 10 seconds to 15 minutes.
4. Completion: Once finished, the interface instantly updates via polling, populating the new issues list and recalculating your dashboard metrics.

When a pull request is scanned, DebtDrone posts a single, continuously-updated comment summarizing the health grade and any new issues, and sets a GitHub commit status on the PR — which you can require as a passing check in your branch protection rules. DebtDrone never blocks a merge on its own; it only reports.

The Issues tab serves as your technical backlog. Scans categorize findings into Security Vulnerabilities (e.g., exposed secrets, CVEs in dependencies) and Code Quality Issues (e.g., function too complex, duplicated blocks).

Granular Code Views

Clicking any issue opens the Issue Detail View. This interface provides the exact file path, the severity level, and a syntax-highlighted code snippet displaying the precise lines affected. You can mark issues as "Ignored" if they represent a false positive, filtering them permanently from future severity calculations.

AI-Powered Remediation (Pro Feature)

For our Pro and Enterprise users, DebtDrone transcends static analysis. When viewing an eligible issue, click "Enable AI Remediation".

• DebtDrone securely contextualizes the affected code and sends it to a large language model.
• The engine proposes an actionable refactoring fix (e.g., extracting interfaces, abstracting logic, or mitigating a vulnerability).
• You review the proposed fix before it's opened as a pull request against your GitHub repository.
• Merging that pull request automatically marks the originating issue as resolved.

We know developers hate context switching. DebtDrone bridges the gap between infrastructure health and project management by converting identified debt into trackable agile tickets directly from the UI.

Configuring External Trackers

• Atlassian Jira: Navigate to Settings -> Integrations. Enter your Jira API Token, Atlassian Email, and Base URL. Once connected, a "Push to Jira" button appears on all issues. You can dynamically select the target Jira Project and customize the Issue Type (Task, Bug, Epic), directly syncing the vulnerability description to the Jira card.
• Trello Configuration: Similarly, supply your Trello API Key and User Token. DebtDrone maps your Trello Workspaces; you can explicitly configure which Trello Board and target Column debt tickets should automatically populate upon synchronizing.

Engineers solve problems at the repository level, but Engineering Managers and CTOs need macro visibility. The Reports tab is your organization's full scan history — every analysis run across every connected repository, in one table.

What you'll see

• Health grade per run: Each scan is stamped with an A–F grade, so you can spot regressions at a glance.
• Trend indicators: See whether a repository's debt is trending up or down run-over-run.
• Run detail drill-down: Click into any run to see exactly what changed and which issues were introduced or resolved.

Reports is part of our advanced analytics feature set, available on Pro and Enterprise plans.

For organizations enforcing strict access boundaries, DebtDrone's Enterprise plan includes SAML 2.0 Single Sign-On, letting your team authenticate through your company's Identity Provider (IdP) — Okta, Google Workspace, Azure AD, JumpCloud, and others.

Because SSO setup involves securely exchanging metadata with your IdP, our team configures it for you rather than asking you to do it yourself. Once you're on the Enterprise plan, reach out to our support team and we'll get your organization connected.

DebtDrone operates on an Organizational model. An Organization encapsulates all connected Repositories, Teams, billing details, and customized settings securely partitioned from other users.

Role-Based Access Control (RBAC)

Invite team members via the Settings panel and assign one of four organizational roles:

• Owner: Full control, including billing and the ability to delete the organization.
• Admin: Can manage billing, invite members, and configure integrations.
• Member: Can trigger scans, view issues, and use configured integrations.
• Viewer: Strictly read-only access for browsing issues and reports.

Plans

• Free: Up to 3 repositories, 10 scans per month.
• Pro ($29/mo): Up to 100 repositories, unlimited scans, plus Jira/Trello integrations, AI Remediation, and advanced analytics (Reports).
• Enterprise: Unlimited repositories and scans, custom integrations, and SAML SSO.

We use Paddle for secure checkout and subscription management — access the Billing tab in Settings to upgrade or change your plan at any time.