Support, FAQ and troubleshooting
Report a bug or give feedback
Use the Feedback button at the top of every page. Include what you did, what you expected, the report name or id, and the time. Never paste source code, tokens, passwords or secret values.
Troubleshooting
| You see | Likely cause | What to do |
|---|---|---|
| Clone failed | Wrong URL or branch, or the host had a problem | Check the URL and branch and retry once |
| Git authentication failed | Token missing, expired or without read access | Create a read-only token and enter it again, or use the GitHub App |
| Scanner "not applicable" | The check does not apply to your stack | Nothing to do; it is listed in coverage |
| Scanner "unavailable" or "unsupported" | Not available in DVSentry yet, or switched off | See the report's coverage; this is not a clean result |
| Scanner "skipped: prerequisite missing" | For example govulncheck without vendored modules, gosec with no parsable Go file | The reason is shown per scanner |
| Scanner "stopped" (timed out) | It used its whole time limit | Findings so far are kept; raise the time limit or narrow scan paths |
| Report stays "queued" | Scan slots are busy with other scans; heavy scanners run alone | Leave it; the page shows jobs ahead and an estimated start |
| History scan stays "fetching" | The deeper clone for Git history is still running | The other scanners continue; it queues when the clone finishes |
| Quota exceeded (402/429 with a reason) | A plan limit was reached | Billing shows which; wait for running scans or change plan |
| Rate limited (429) | Too many requests | Wait for Retry-After; do not retry in parallel |
| MFA required | Your organization or role requires MFA | Settings → Account Security → Set up MFA |
| Web target rejected | Domain proof older than 24 hours, private address, redirect to another host, or a TLS error | Verify the domain again and fix the target or its certificate |
| Cloud permission error | The identity lacks a read permission | Add the read named in the report to the dedicated identity, not an admin account |
| AI provider error | Key invalid, model unavailable or provider out of credit | Check the key and your provider account |
| A feature says "not configured" | That third-party connection is not set up yet, or the feature is switched off | Nothing to do on your side |
| 404 on a resource you expect | It belongs to another organization, or your token is limited to another organization | Check the selected organization and the token's organization |
FAQ
Does DVSentry keep my source code? No. Code is cloned into a temporary workspace, scanned in an isolated container with no network, and deleted. DVSentry keeps findings, reports and the SBOM. A version-bump patch (your file content) is kept encrypted for one hour.
Does DVSentry store my repository token? Only if you save it in the Secret Vault. Otherwise it is used for one clone and discarded. Scanners never receive it.
Can DVSentry change my cloud account or repository? No. Cloud identities are read-only and scans never write to a repository. Fix pull requests write only to a repository you opted in, with a separate app.
Why can I not scan any website I like? You must prove you own the domain first. This protects other people's sites.
Does a clean report mean I am secure? No. It means the checks that ran found nothing. The report lists what ran and what did not.
Are compliance packs a certification? No. They organise evidence for your auditor and never say a control is met.
Where is my data hosted? The beta runs in India (Google Cloud, asia-south1), behind Cloudflare.
What happens when my trial ends? Your organization moves to its own plan or Free. Reports and history are kept for the plan's retention.
Which AI provider does managed AI use? Google Gemini during the beta. If you need a specific provider, bring your own key.
Security disclosure
Report a vulnerability in DVSentry through /security.txt.
Something missing or unclear? Tell us with Feedback in the app.