Billing and retention
How Code Security is billed per scan and for AI review tokens, where to see this month's usage, and how long scans, logs and findings are kept.
What you pay for
- Each scan of a push, pull request, nightly run or manual scan is billed once.
- AI code review, when it's on, is billed by the tokens it uses (input and output), per scan. Explain differently on an AI finding uses tokens too.
There's no free plan. Scans and AI tokens appear on your monthly invoice as separate Code Security lines. The This month card on the Code Security overview shows this month's scans, AI tokens and the total so far at the current prices. See your price list in the console for current prices.
How long things are kept
| What | Kept for |
|---|---|
| Scans and their logs | 45 days. A repository's latest scan is always kept |
| Fixed findings | 45 days |
| Open findings | As long as they're open |
| Daily open-finding counts (for the trend chart) | About 13 months |
Disconnecting a repository deletes its findings, scans and history right away.
Related
API, webhooks and CI
Gate deploys on Code Security results in Infraista Pipelines or any other CI, read scans and reports through the API, and get signed webhooks.
Container Registry
Store private Docker images in Infraista, push and pull them with robot tokens, deploy them from Pipelines and Kubernetes, and scan them for vulnerabilities.