VEYRA
Sign In Get Security Assessment

// DOCUMENTATION

Documentation.

How Veyra connects, what it requests, how assessments run, and how to read what comes out. Published openly wherever doing so does not expose sensitive implementation detail.

Overview

Veyra is a continuous application security platform. It analyzes the repositories, applications, APIs, and external assets you explicitly authorize, correlates the results, and delivers findings ranked by the risk they create for your business.

This documentation covers onboarding and integration. Deeper reference material — the assessment methodology, the severity model, and the data-handling architecture — lives on dedicated pages linked in the sidebar.

How onboarding works

Six steps, typically completed in under an hour of your time.

  1. 01

    Create your organization

    Company name, website, industry, number of developers, and a primary technical contact. This establishes the tenant that everything else is scoped to.

  2. 02

    Authorize assets

    Before any testing begins, you explicitly authorize what Veyra may assess: repositories, domains, applications, and APIs, together with testing limitations and environment restrictions. Veyra records the authorizing individual, a timestamp, and the agreement version.

  3. 03

    Connect your repository

    Install the Veyra GitHub App and select specific repositories. Read-only. See GitHub integration.

  4. 04

    Add applications

    Provide the authorized domains that make up each application — for example app.customer.com and api.customer.com — and confirm ownership or authorization for each.

  5. 05

    Configure the scan

    Choose environments (production, staging, development), allowed domains, excluded endpoints, maximum request rate, and maintenance windows. These limits are enforced on every run.

  6. 06

    Begin the assessment

    Progress is visible in the dashboard as each stage completes: repository mapped, dependencies analyzed, secrets analyzed, API routes mapped, authentication analyzed, authorization analyzed, external surface analyzed, findings correlated, report generated.

Core concepts

ORGANIZATION
Your tenant. All assets, findings, users, and audit records belong to exactly one organization, and isolation is enforced at the data layer.
AUTHORIZATION AGREEMENT
The record that permits Veyra to assess specific assets. Testing cannot begin without one, and changing scope creates a new version.
ASSET
A repository, application, domain, or API that Veyra monitors. Plan limits are counted in applications and repositories.
ASSESSMENT
One complete analysis run across your authorized assets, producing a set of findings and a report.
FINDING
A single security issue with severity, confidence, evidence, an attack path where relevant, and remediation guidance. Identified as VYR-nnnn.
SECURITY SCORE
A 0–100 summary of observed posture across eight weighted categories. Not a guarantee — see the model.

Finding lifecycle

Findings move through a defined set of states. Every transition is recorded in your audit log with the actor and timestamp.

StateMeaningWho sets it
OpenDetected and awaiting triage.Veyra
VerifiedEvidence confirmed, and where included, reviewed by a security engineer.Veyra
InvestigatingYour team has picked it up.You
FixedYou believe remediation has shipped. Triggers a rescan.You
ResolvedRescan confirmed the issue is no longer present.Veyra
RegressedA previously resolved finding has reappeared.Veyra
False positiveMarked by you as not a real issue, with a reason recorded.You
Accepted riskAcknowledged and deliberately not being fixed, with a reason and optional review date.You

Frequently needed answers

Common questions

How long does the first assessment take?
Five to ten business days depending on the package and the size of your environment. Progress is visible throughout — you are not waiting in silence.
Does Veyra need production access?
For code analysis, no — only read access to repositories. For external surface monitoring, Veyra needs to reach your authorized hosts over the public internet, exactly as any user would. No credentials, VPN access, or infrastructure access is required.
Can we exclude parts of a repository?
Yes. Paths can be excluded from analysis, and endpoints can be excluded from external testing. Exclusions are recorded in the authorization agreement and honored on every run.
What happens when we revoke access?
Assessments stop immediately and any run in progress fails closed. Your existing findings and reports remain available until you request deletion. See Customer Control.
Is there an API?
A read API for findings and assessment status is planned for phase three, alongside webhooks and SIEM export. It is not available today, and this page will say so until it is.