Skip to main content
The Pentest scope page is a read-only view of what a pentest works from: its targets, repositories and supporting documents. PR review repositories are switched on from the PR Reviews page instead. Open it from Settings > Pentest scope on the Agentic whitebox page, or from the command palette as Pentest scope. If you have more than one configured pentest, use the pentest selector in the page header to switch between them. The full-scan sections are read-only. To change any of them, use the Edit in Setup Wizard button, which takes you back to the wizard with the current configuration loaded as a draft. The button appears only once a pentest has a configuration.

PR Reviews

The PR Reviews section lists every repository your connected GitHub integration can reach, each with a toggle. Turning a repository on is all it takes to start reviewing its pull requests. You don’t need a full-scan configuration or a completed pentest run first. If you have connected Azure DevOps, a second PR Reviews · Azure DevOps section lists those repositories in the same way. Each row shows the repository name and the branch reviews run against. Switching a repository on expands its settings; collapse them again with the chevron to keep a long list readable. Every control saves as soon as you change it. The threshold field saves when you click away from it.
In open-only mode, when new commits land after a review, Odin updates its comment on the pull request with a Run Review button that links back to Odin, so you can run the next review without leaving GitHub.

PR Reviews

Learn how the PR review flow works end to end

Targets

The Targets section shows the primary target URL Odin tests, plus any extra domains in scope. These come from Step 2: Scope & Connectivity of the setup wizard.

Repositories

The Repositories section shows the primary repository and any additional repositories Odin analyses for this pentest, each with its branch and, where one is set, its subdirectory. These come from Step 3: Code & Documentation.

Documents

If you uploaded supporting documents in Step 3, they appear here so you can see what Odin has on file. To replace them, use Edit in Setup Wizard.

When nothing is connected yet

With no pentest configuration and neither GitHub nor Azure DevOps connected, the page shows a Connect GitHub to enable PR reviews card instead of the sections above. Installing the GitHub App from there lists your repositories and lets you turn reviews on without going through full-scan setup. The same card also sits above the sections whenever GitHub is not connected. Connecting needs the Member role or higher; Read only members are told to ask a colleague.