Documentation

Using Hivekeeper

Everything you need to connect repositories, find what will break, and ship the fixes.

What Hivekeeper does

Your code depends on things you don't control: third-party APIs change versions, packages reach end of life or get vulnerabilities, and cloud providers retire instance types, runtimes and engine versions. Hivekeeper reads your repositories, builds an inventory of those dependencies, flags what is breaking or about to, and opens pull requests that fix it.

Layer	What it finds
Third-party APIs	SDKs and raw HTTP calls to payment, messaging, email, cloud, AI and analytics services (Stripe, Twilio, AWS SDKs, OpenAI and more), with the file and line, and deprecated API versions.
Packages	Dependencies with their exact versions from manifests and lockfiles (npm, pip, Poetry, Maven, Gradle, Go, Cargo, Bundler, Composer, NuGet), known vulnerabilities, end-of-life and recommended upgrades.
Infrastructure	Terraform, AWS CDK, CloudFormation, Pulumi, Serverless, Docker and Kubernetes: deprecated resources, instance types, database engine and runtime versions on AWS, Azure and GCP, and removed Kubernetes APIs.
Mobile	Xcode, iOS deployment target, Android target and compile SDK, Gradle plugin and store deadlines from Apple and Google Play.

Quick start

Create an account (or sign in with GitHub). You get an organization on the Dev plan.
Connect GitHub, GitLab or Bitbucket and choose the repositories Hivekeeper may read (see Connect your code).
Each repository you add is scanned right away (an AI deep scan from your allowance, or a free rule-based scan if none is left) and gets a daily schedule at 02:00 in your time zone, which you can change.
Open a repository to see its findings and inventory. Run another AI deep scan any time.
Select issues and choose Create fix PR. Review and merge it like any other pull request.

Connect your code

GitHub

Install the Hivekeeper GitHub App on your account or organization and pick Only select repositories to limit what it can see, or sign in with GitHub and add repositories you have access to. Fix PRs are pushed to a new branch; Hivekeeper never pushes to your existing branches or merges anything.

GitLab and Bitbucket

Owners and admins connect GitLab (gitlab.com or self-managed) and Bitbucket Cloud on the Integrations page. Credentials are encrypted and only sent to that host. Merge requests are opened for GitLab.

Removing a repository from the GitHub App, or disconnecting an integration, stops its scans. Its history stays until you delete the repository in Hivekeeper.

Scans

	Rule-based scan	AI deep scan
How	Fast detectors for known manifests, SDKs and IaC.	Hivekeeper's AI engine reads the repository after the rules, and adds raw HTTP calls, vendors and manifests the rules don't know, and IaC they missed.
When	On demand, on push (Enterprise), and when a deep scan can't run (see Schedules).	When a repository is added, on demand, and on each repository's schedule when there are new commits.
Cost	Free and unlimited on every plan.	Uses your monthly allowance, then pay as you go by repository size.
Time	Seconds to a minute.	A few minutes; large repositories take longer.

Every scan clones one branch at depth 1 into a temporary directory that is deleted when the scan finishes. A rescan of the same commit within 24 hours doesn't count against your allowance, and a scan that fails is never billed.

Schedules

Each repository has a schedule: off, hourly, daily, weekly or monthly, at a time and time zone you choose (repository page → Settings). At that time Hivekeeper checks the branch:

No new commits: nothing runs and nothing is charged. The repository is marked up to date.
New commits: an AI deep scan runs. It uses a scan from your monthly allowance.
Allowance used up: if an owner or admin turned on automatic charges on the Billing page, the scan runs and is charged pay as you go; otherwise it runs as a free rule-based scan until the allowance resets on the 1st.
Payment failed, or your monthly usage limit is reached: scheduled scans are rule-based until it's resolved.

Hourly schedules on busy repositories can use an allowance quickly. Daily or weekly is right for most teams; set a monthly usage limit on the Usage page if you turn on automatic charges.

Findings and issues

A scan produces an inventory (APIs, packages, infrastructure) and issues, each with a severity:

Severity	Meaning
High	Known vulnerability, end-of-life or removed version or API: it is broken or will break soon.
Medium	Deprecated, with a deadline in the future.
Low	Recommended upgrade.

Each finding links to the file and line it came from. Inventory shows every API, package and resource across all repositories, with filters, so you can answer “where do we still use X?” at once.

Fix pull requests

On a scan, select one or more issues and choose Create fix PR.
Hivekeeper checks out a new branch, makes the smallest complete change (the dependency, resource or API usage, and the code that must change with it), and opens a pull request.
The PR description lists every changed file, the breaking changes handled, what to test, follow-ups (for example npm install to refresh a lockfile), and a risk rating with confidence.

Changes to CI files are called out in the PR. Nothing is merged for you: your normal review and checks apply. A fix PR counts against your allowance when it's opened. If the PR is closed without merging, you can retry the fix.

Architecture map

On a repository's Architecture tab, choose Draw the architecture map. Code Keeper reads the code and maps its components (apps, APIs, services, workers, data stores and third-party services), what each one depends on, and the main flows through them, such as sign-up or checkout. It takes a few minutes, and the map is kept for that commit; when new commits arrive you can redraw it.

The map shows what a change means for the rest of the system:

Changes here (red): the components an issue is in, or a fix PR changes.
May break (amber, dashed): components that depend on those and could be affected.
Flows to test: the flows that pass through the changed components.

On a scan, choose Show on map on any issue; on a pull request, choose Show on map to see what it changed. Fix PRs opened after a map is drawn also list the changed components, what may be affected and the flows to test in their description. The first map of each repository is free. Each later one is charged per map, by the repository's size: the price is shown before you draw it, you confirm it, and it's added to your next invoice once the map is drawn (a failed drawing isn't charged). Maps don't use your scan or fix allowance. Hovering, highlighting and tracing flows on a drawn map are always free.

Integrations

Tool	What it does
Jira	Create tickets for selected issues (or automatically for every high-severity issue); the ticket is updated when a fix PR is opened and merged.
ServiceNow	Record a change request (or incident) for each fix PR, with its risk, test notes and back-out plan.
Slack	Post high-severity issues as scans find them, and fix PRs as they're opened and merged.
SIEM	Stream audit events to Splunk, Datadog or any webhook (Enterprise).

Set them up on the Integrations page. A broken integration never fails a scan: errors are shown on the integration.

Private registries

If your packages come from a private registry (npm, PyPI, Maven, NuGet, Cargo, RubyGems, Go or CDK construct libraries), add it under Settings → Private registries (Startup and Enterprise) so your internal packages are checked against it too. Credentials are encrypted.

Team, roles and SSO

Role	Can
Owner	Everything, including deleting the organization.
Admin	Members, settings, integrations and billing.
Manager	Repositories, scans and fixes; no billing, settings or members.
Developer	Run scans and create fix PRs on repositories they can see.
Viewer	Read only.

Teams can limit which repositories developers and viewers see. Enterprise organizations can require single sign-on with Microsoft Entra ID, Okta, Google Workspace or any OpenID Connect provider: see the SSO setup guide. Two-factor authentication is available to everyone.

Audit log

Every action (sign-ins, scans, fixes, settings, billing, member changes) is recorded in a tamper-evident log: each entry is chained to the previous one by hash. Startup keeps 90 days and Enterprise 365 days of searchable, exportable history; Enterprise can stream it to a SIEM.

API keys and webhooks

Enterprise organizations can create scoped API keys and outbound webhooks (scan completed, fix PR opened, fix PR merged, payment failed). Webhooks are signed with HMAC-SHA256 and retried with backoff for several hours.

Plans, usage and billing

Allowances: each plan includes repositories, AI deep scans and fix PRs per month, pooled across the organization. They reset on the 1st and don't carry over. See Pricing.
Size bands: beyond the allowance a deep scan is priced by the repository's size: small (up to 20,000 lines), medium (up to 200,000) or large.
Manual scans show the price before they start and ask first.
Scheduled scans beyond the allowance are only charged if an owner or admin turned on automatic charges on the Billing page, after agreeing to pay-as-you-go charges to the card on file. Turning them on or off is recorded in the audit log and confirmed by email. Turn them off at any time.
Usage limit: set a monthly ceiling on pay-as-you-go charges on the Usage page. Once it's reached, scans that would cost money pause until next month.
Invoices: charges beyond the allowance appear on the next monthly invoice. A summary is emailed a few days before.
Failed payments: automatic charges and scheduled AI deep scans stop at once, and owners and admins are reminded by email every two days. After 7 days the organization becomes read-only (everything stays viewable; no new scans, fixes or repositories) until the invoice is paid.

Security

How we handle your code and data, the AI engine's sandbox, encryption and our SOC 2 plans are on the Security page.

FAQ

Does Hivekeeper keep a copy of my code?

No. Each scan and fix works in a temporary checkout that is deleted when it finishes. We keep the results: file paths, line numbers, the short line of evidence for each finding, versions and the fix PR details.

Is my code used to train AI models?

No. The AI engine runs Claude on Amazon Bedrock, which doesn't use your inputs or outputs to train models, and we don't either.

Can a file in my repository change what the AI does?

It shouldn't. Repository content is treated as data, not instructions; the engine can only read (and, for fixes, edit) files inside the temporary checkout, can't run commands or reach the network, and ignores settings, hooks and agent instructions shipped in the repository. If it notices instructions aimed at it, it says so in the scan summary.

What happens when I cancel?

You keep your plan until the end of the period (Enterprise: the end of the annual term). Then the organization moves to Dev. Repositories and history stay.

Need help?

Use the chat in the dashboard, or email support@hivekeepr.com.