Help
Invince is designed around a simple rule: analyze, explain, recommend, and verify; then leave coding changes to the customer or their own toolchain. That gives you evidence without handing over control of the repository.
AI assistance
Bring your own provider
Agent handoff
Invince identifies the issue and files it to GitHub with a stable doccraft:fix-me label. Your own agent then watches that label, fixes the code in your repo, and opens a PR using its own credentials.
Watch the label on GitHub issues and trigger a fix workflow with your own Anthropic key.
Use a background agent trigger set to issue labeled = doccraft:fix-me.
Assign or route labeled issues into your normal issue-to-PR workflow.
Paste a public link. You get Ready / Fix first / Do not launch, with a reason. not a pile of extra empty slots.
Put that app in Watch. Graphs show response time, findings, and verdict. Email fires when the verdict or a functional page break moves, not when CSS class hashes change.
Health, findings, hits, logins, bots, and what people do each have a Why note: why this is high, why signup is thin, why bots dominate.
Launch gate on pull requests, generated docs that drift with the repo, and first-party traffic. Bring your own AI key when the shared quota runs out.
Browse by category or search for a specific question.
Getting Started
What is a workspace?
A workspace is the home for your team, projects, and access roles. Everything (members, projects, security findings, audit history) lives inside a workspace.
Getting Started
What is a project?
A project is a single application inside your workspace, usually tied to one repository. You connect a project to start scanning it for issues, errors, and documentation.
Getting Started
What is a repository?
A repository (or "repo") is your project's codebase, tracked by Git. You can connect GitHub (App), GitLab, or Bitbucket (read-only token). Connecting lets Invince read files and run checks. Invince does not merge your code.
Getting Started
What is deployment?
Deployment is the process of taking your code and making it live on the internet, so real users can reach it.
Getting Started
How do I check a public app?
Sign in, then paste a public https link you own on Check. You get Ready / Fix first / Do not launch from that page. Free accounts have a monthly allowance; the same link within 24 hours is cached. Connect GitHub for source findings. A public check cannot read private code.
Getting Started
What is Launch QA?
Live Checks is the one ship board for an app you own: GitHub scan, public URL, tests on disk, suite/API runs, Playwright/Cypress/Selenium/Robot on GitHub-hosted runners, lcov/k6/eval ingest, CLI upload, and SDK. Unchecked stays Unchecked. Invince does not generate load from Cloud Run. The GitHub launch gate still stays Ready when those QA rows are missing; a failed k6 summary is Do not launch there.
Getting Started
What is Quality Hub?
Quality Hub stores cases, suites, manual runs, same-origin API checks, browser jobs Invince starts on GitHub-hosted runners, lcov/k6/eval ingest, and a fail-closed gate. Ready requires stored passing evidence. Skipped or missing runs stay Unchecked. Invince does not generate load from Cloud Run.
Getting Started
What is a quality evidence pack?
Evidence downloads JSON of stored Quality Hub statuses. Unchecked is not Ready. Admins also get quality write audit rows, including CLI ingest. It is not a certification, pentest, or compliance letter.
Getting Started
What is Improve?
Improve ranks stored security findings, technical debt, runtime errors, performance samples, docs drift, and GitHub launch gates into the three most valuable actions. The basic plan is free and does not call Gemini. An optional in-depth report spends one shared AI request after showing remaining quota and an estimated cost. Invince does not change your code; you copy a prompt into your own coding assistant, then Invince remeasures.
Getting Started
Is there a Simple vs Developer mode?
No. After sign-in everyone sees the same workspace: ship verdict, Quality Hub, Live Checks, Watch, errors, and security. Specialist screens are not hidden behind a role toggle.
AI Coding Tools
How do I connect my coding agent?
Open Agent in the workspace. Copy the engineering prompt (every plan), or file a GitHub issue labeled doccraft:fix-me if GitHub is connected. Live MCP, so the agent can list findings and errors without pasting, is Pro. Invince does not edit your repo.
Account
What happens after I plan a fix?
Give the work to your coding agent, ship, click Claim fixed, then turn on an alert so you hear if it returns. Put invince check and invince verdict in CI so a down URL or a non-Ready public check fails the job.
AI Coding Tools
Does Invince re-run AI or GitHub scans every time?
No. If the repo HEAD has not moved in the last 24 hours, Sync reuses the last completed scan and skips GitHub blobs, scanners, and docs AI. Docs skip AI when facts_hash is unchanged. Platform AI answers are reused for the same prompt for 7 days and do not spend quota. Your own AI key is never cached into that pool. Check Again on a finding, and a new commit, still run for real.
Projects
How do I add a project?
From your workspace dashboard, go to Connect and click New Project. Then connect GitHub, GitLab, or Bitbucket.
Projects
Can I have more than one project per workspace?
Yes, but paid value is depth on the apps you actually run, not a warehouse of empty slots. Free covers 1 connected app, Pro 3, Business 10.
GitHub
How do I connect GitHub?
Open the project, choose Connect a repository, install the Invince GitHub App, and pick the repo.
GitHub
Can I connect GitLab or Bitbucket?
Yes. On Connect a repository, paste an https GitLab or Bitbucket URL and a read-only token. Invince downloads an archive and runs the same file scanners as GitHub. It cannot post merge-request check runs. Use Before deploy for the same Ready / Fix first / Do not launch rules on the last scan. Self-hosted GitLab outside gitlab.com is not supported.
GitHub
What access does the GitHub App need?
Read access to contents, metadata, and pull requests so Invince can scan and score a PR. Checks: write so the launch gate can post Ready / Fix first / Do not launch. Actions: write so Invince can start Playwright, Cypress, Selenium, or Robot on GitHub-hosted runners. Invince does not merge. A proposed fix PR is optional and only if you turn on allow-fix-PRs and grant write access. You still review it.
GitHub
How do I disconnect GitHub?
Uninstall the Invince app from your GitHub account's Settings → Applications, or disconnect it from your project's settings page. This immediately revokes access.
Errors
What is a stack trace?
A stack trace is the list of steps your code was in the middle of when it crashed, read top to bottom. It usually points to exactly where the problem happened.
Errors
How do I fix an error?
Open the error page. Read what happened. Copy the engineering prompt into your coding assistant. After you ship the fix, click Claim fixed. If the same error comes back, Invince reopens it. After 14 quiet days it is confirmed fixed.
Errors
What does "regression" mean?
A regression is a problem that was previously fixed and verified, but has come back, usually because a later code change reintroduced it.
Security
What is a vulnerability?
A vulnerability is a weakness in your application that could let someone do something they shouldn't, like accessing data that isn't theirs.
Security
What is authentication?
Authentication is proving who someone is, usually by checking a password or login link. See the Learning Center's glossary for more terms like this.
Security
What is authorization?
Authorization is deciding what someone who's already logged in is allowed to do or see. It's different from authentication, which just checks who they are.
Security
Does a passing scan mean my app is 100% secure?
No. A passing scan means the checks we ran didn't find a problem; it doesn't mean no problem exists. Treat findings marked "Not checked" or "Not applicable" honestly, and use human review for anything consequential.
Security
Can I mark a finding as a false positive?
Yes: open the finding and use the status controls to mark it reviewed, ignored, or a false positive. You can add a note, and the decision is kept in the finding's history.
Security
Does Invince know if a leaked key still works?
For Stripe live keys, GitHub tokens, OpenAI, Anthropic, Google AI, and Slack tokens found in your connected repo, Invince asks the provider whether the credential still authenticates. The value is not stored. AWS access-key IDs cannot be checked without the secret half. The finding page lists rotate steps for that vendor. Invince does not revoke the key for you.
Security
How do I fail a pull request when a key is committed?
Install the GitHub App so Invince can post a launch-gate check. Also copy scripts/ci-secret-gate.mjs and the example workflow into your repo so GitHub Actions fails on the checkout even without the App.
Security
Can I check someone else’s website?
No. You must own the app or have permission. Tick the box on Check. Report abuse at /report if someone scanned a system they do not own.
Getting Started
Is there a demo without connecting GitHub?
Yes. /demo shows a canned public-check result. No live site is requested.
Fix Prompts
What is a fix prompt?
A fix prompt is a detailed, ready-to-paste instruction set for your coding assistant (Claude Code, Cursor, Copilot, etc.): it includes the problem, the evidence, the affected files, and what a good fix should do.
Fix Prompts
How do I use a generated prompt?
Copy it and paste it into your coding assistant's chat. The assistant makes the change in your own repository; this platform never edits your code directly.
Fix Prompts
How do I check whether a fix worked?
After you push the change, click Claim fixed. For a security finding, the next repository sync is the proof. For a runtime error, keep the SDK installed: a matching event reopens the issue, and 14 quiet days means confirmed. Claim fixed is not a scanner re-run by itself.
AI Coding Tools
Which coding assistants are supported?
Fix prompts are written to work well with Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini, and ChatGPT, or as a generic prompt for any assistant.
AI Coding Tools
Does the platform use my own AI key?
For AI-powered features like investigation and fix generation, yes: add your own provider key in Settings → AI. Without one, some features fall back to a shared platform key with lower limits.
Deployment
What is an environment variable?
An environment variable is a setting or secret (like a password or API key) stored outside your code, so it can be different between your computer and your live, deployed app without editing files.
Deployment
What does "Launch Check" check?
It checks things like secrets handling, authentication, dependency vulnerabilities, error handling, and more, then gives each category a score based on real evidence from your project, explained plainly rather than left as a single unexplained number.
Deployment
What is Before you deploy?
It applies the same Ready / Fix first / Do not launch rules to the last completed scan, without waiting for a pull request. It is not a preview of uncommitted files.
Projects
What is Archaeology?
Files in the last software graph that nothing else imported, plus unused exports and TODO comments from that scan. Dynamic imports and other repos are not visible, so it is a lead, not a delete list.
Account
How do I search with a sentence?
Press Cmd+K or Ctrl+K. Phrases like “auth problems this month” open security findings from the last 30 days. “Go to launch” opens Before you deploy.
Documentation
How is documentation generated?
The platform reads your connected repository. code, routes, and structure. and writes documentation grounded in that, not generic filler. You can regenerate sections as the project changes.
Documentation
What is documentation drift?
When a commit changes facts the docs were generated from, Invince flags those pages for review. Drift is a reason a launch gate can say Fix first. Regenerating or accepting the new facts clears it.
Watch
What does Watch actually see?
Every day Invince re-checks the public page of the app in your Watch slot: uptime, HTTPS, verdict, and public HTML. You get a bell notice and an email when that surface moves, plus graphs for response time, findings, and Ready / Fix first / Do not launch. Visitor errors need the browser, Node, or Python SDK on a connected project and the Watch “app breaks” switch (or Profile → live errors). Watch cannot see other people’s logins.
Watch
Will Watch email me when a visitor hits an error?
Yes, once the Invince SDK is on that app and the error reaches a project you own or admin. A new issue, or one that comes back after Claim fixed, emails you through Resend if Also email me is on in Profile. The Watch “app breaks” switch also turns this on. Repeated events on the same fingerprint do not send another email. If mail is not available on this instance, the bell still works. A public URL check cannot see in-app exceptions.
Account
How do notifications work?
The bell in the nav shows job results, new critical findings, live errors, bot floods, alert thresholds, Watch changes, and agent loops. The same events email you when Resend is set and you leave “Also email me” on in Profile. Alert rules can also Slack or email a specific address.
Account
How do invites and affiliates work?
The affiliate program is Whop only. Click Join affiliates on Whop at /affiliates, finish there, and use the share link Whop gives you. Whop pays 15% when they buy Pro ($19/mo) or Business ($49/mo). Invince does not hold that payout. A separate invite link on Profile can add one extra free check when a friend signs up. That is not the affiliate program.
Account
What happens if two people connect the same GitHub repo?
A GitHub repository can only be connected to one Invince project at a time. Disconnect it there first if you need to move it.
AI Coding Tools
Is the SDK Datadog for AI agents?
For the agents you run, yes in shape: wrap a task with startAgentTrace(), record LLM/tool steps with tokens and costUsd, finish(). Invince charts 7-day spend, tokens, and stuck loops (same step 4 times in a row or 6 times in a run) and notifies when a loop trips. It does not run the model or guess provider prices.
Watch
How do I see traffic, logins, and bots?
Install the Invince browser SDK on the app you own and open Traffic. Hits, new logins, bot floods, and “what people do” are first-party. A public URL check cannot do that.
Graphs
Why is a number high or low?
Each graph has a Why note under it. Health is high in the 85+ band and low when critical (−25) and high (−12) findings stack. Findings are high when the last scan left real file evidence unconfirmed. Bot hits are high when a visitor looks scripted or crosses 80 hits in an hour.
Graphs
Why aren’t people signing in or subscribing?
On your app, signup rate is new logins divided by human hits (bots removed). 0 logins with real hits usually means captureLogin() is missing, the login control is not on the pages the SDK sees, or visitors bounce. If bot hits dominate, they are not going to subscribe. For Invince itself, Free already gives the launch verdict, graphs, and a launch gate. People pay for more apps, Watch slots, ingest, AI, and a BYOK key.
Getting Started
Why not just use Sentry or UptimeRobot?
Sentry and GlitchTip win if you only want deep error tracking after an SDK is installed. UptimeRobot wins if you only want a ping. GitGuardian and Gitleaks win as secret firehoses. Invince is for the launch question: public URL plus optional GitHub, leaked keys, docs drift, and a ranked next action that you run in your own editor. It does not rewrite your repo.
Errors
Can I keep the Sentry SDK?
Yes. Point the DSN at https://YOUR_INGEST_KEY@your-invince-host/0. The SDK posts to /api/0/envelope/. Sessions and transactions are ignored with HTTP 202. Exceptions become Invince issues. Browser-extension stacks are dropped. Dashboard Send test error events do not count toward error-volume alerts.
Watch
Is there a JSON status URL?
Yes, for a Watch check you own: GET /api/badge/{id}/status returns verdict, working, HTTPS, response time, and checkedAt. The SVG badge stays at /api/badge/{id}.
Troubleshooting
I can't log in, what should I check?
Make sure your password meets the requirements shown on the signup form (uppercase, lowercase, a number, and a symbol). If you just signed up, check your email for a confirmation link if one was required.
Troubleshooting
My GitHub connection stopped working
Use Connect GitHub on the project again. If the App was uninstalled on GitHub, install it from that same button.
Account
Where are the product docs?
Open /docs. Sidebar on the left, search at the top, pages for Check, Watch, GitHub, SDKs, billing, and support. Longer than this FAQ.
Account
How do I get help from a person?
Open Support from the bubble in the corner, the sidebar, or /support. Chat answers product questions. Send an issue or a star rating from the same place. We read every note.
Account
How do I change my skill level?
Go to your Profile page: there's a "Skill level" section you can change at any time.
Account
How do I sign out?
Open your Profile page and use the Sign Out button at the bottom.
Account
Do I have to agree to Terms and Privacy?
Yes. Public pages (pricing, Terms, Privacy, Cookies, DPA) are readable without an account. Creating an account requires two ticked boxes. After sign-in, if we do not have your agreement on file, you land on /agree and cannot open Check, Watch, or a workspace until you tick them again. Current Terms and Privacy took effect 8 October 2026.
Account
What cookies does Invince set?
Only what is needed to sign you in, finish login, and reopen a Check you just ran. The list is on /cookies. Affiliate codes live in localStorage. There are no analytics or ads cookies today. Paid checkout is Whop (Stripe under Whop).
Security
If Gitleaks is missing, is the repo clean?
No. Security shows Gitleaks and OSV as Checked or Not checked after each sync. A missing binary is not a pass. The built-in secret scan still runs on files Invince fetched.
We use only the cookies necessary to keep you signed in. No analytics or advertising cookies are set. Cookie list