Common Questions

You will finish this page able to diagnose the problems people actually hit: an empty scan, a pull request that was not reviewed, a gate that did not block, an error code you have not seen before.

Scanning

My scan finished but found nothing

Work through these in order.

1. Is the repository actually granted to the GitHub App? Installing the App on an account is not the same as granting it a repository. Go to Settings → Integrations → Source Control, click through to the GitHub installation, and confirm the repository is in the selected list. A repository Argus cannot read produces an empty scan, not an error.
2. Is the branch right? Argus scans the project's configured branch. Check it on the project's Settings tab.
3. Does the repository have lockfiles? SCA reads lockfiles, not manifests. A repository with package.json but no package-lock.json, yarn.lock or pnpm-lock.yaml yields no dependency findings.
4. Is it a language Argus analyses? See what each engine covers.

My Java or .NET dependencies are not being scanned

Argus does not yet parse pom.xml, Gradle files, .csproj or packages.lock.json for advisory matching. Those packages still appear in your SBOM and in container scan results, but they are not matched against CVEs by the dependency engine.

Workaround: if you build a container image, Argus scans its base image and reports the application packages inside it, which covers a lot of Java and .NET in practice.

Everything in my Go / Maven / Rust / Ruby project is marked "reachable"

That is correct and deliberate. Argus performs import-level reachability analysis for JavaScript/TypeScript and Python only. For every other ecosystem it reports reachable rather than guessing, a wrong unreachable would hide a real vulnerability, which is the one failure mode worth avoiding at all costs.

A scan failed. Was I charged?

No. A failed scan is refunded automatically. The credits are returned and the rule-scan slot it consumed is restored. Check Settings → Billing → Credit history for a refund:scan-failed entry.

The Timeline and Live logs tabs on a scan job are empty or unhelpful

Those two views are not yet available and do not show recorded execution data. Use the Details tab, the coverage chips on the completed job, and the Issues workspace instead.

Can I schedule recurring scans?

Not reliably yet, scheduled scanning is coming soon. Drive periodic scans from your own CI cron or from the API in the meantime:

curl -sS -X POST "$ARGUS_URL/api/graphql" \
  -H "Authorization: Bearer $ARGUS_API_KEY" -H "content-type: application/json" \
  -d '{"query":"mutation($p:ID!){TriggerScan(projectId:$p,scanDepth:"standard"){id status}}","variables":{"p":"'"$PROJECT_ID"'"}}'

Argus also scans a project automatically when a pull request merges.

Findings

There are too many secret findings and most look wrong

Two things to do.

1. Re-verify the batch with AI. Select them on Issues and click Re-verify with AI. It re-runs triage against the stored evidence and auto-marks confident false positives. 2 credits per batch of up to 25.
2. Turn off the rule. Settings → Rules → Secret Rules, find the rule producing the noise, toggle it off. It stops reporting new findings from the next scan. Existing findings stay open, Argus does not silently close your backlog.

Argus already filters out the usual noise sources before reporting: test and fixture paths, documentation placeholders, publishable keys, environment-variable references, git SHAs, integrity hashes, lockfiles, and *.example.* files.

Why is a MEDIUM ranked above a CRITICAL?

Because priority is not severity. Argus multiplies the severity anchor by exploitability signals and by reachability:

score = anchor × (1 + EPSS + KEV + exposure + attack-path) × reachability-multiplier

An unreachable CRITICAL is multiplied by 0.25. A reachable MEDIUM on a KEV-listed CVE is multiplied up. That is the ordering you want when you have one afternoon and three hundred findings. Full formula in Concepts.

A finding disappeared without anyone resolving it

A re-scan that no longer reports a finding auto-resolves it. That is normal. It means the fix landed, or the code moved.

Reconciliation is scoped to the categories a scan actually covered, so a standard scan will never wipe out findings that only a Deep Agentic scan produced.

"Assign to Agent" did not open a pull request

Check the outcome shown in the modal.

Also confirm the Argus GitHub App has Contents: write on that repository, the agent needs it to create the branch and commit.

And check whether your organization requires approval for agent actions. If Fixes require approval is on, the run queues on the Agent Requests page until an Admin approves it.

Pull requests

Argus did not review my pull request

1. Is the App installed on that specific repository? The Pull Requests page shows Not reviewed: which means exactly that, and is never a claim that there were no findings.
2. Was the PR opened before you installed the App? Argus reviews on opened, synchronize and reopened. Push a commit to trigger a review of an existing PR, or use Sync from GitHub with the project selected to import history.
3. Is it closed or merged? Argus never reviews a closed or merged pull request.
4. Did you run out of credits? Each auto-review costs 5 credits.

The review missed something obvious in a new dependency

Pull-request review scans the diff, using source analysis and secret detection. It does not run full dependency advisory matching on every PR.

To catch a bad dependency at the moment it is added, use the scan_package MCP tool in your AI coding assistant. It returns allow / warn / block before the install runs. See Integrations. A full project scan on merge catches it too.

The check is red but the merge button is still enabled

Posting the check and requiring the check are two separate things, deliberately. Argus posts Argus / security-review; you make it required, with your own GitHub admin credentials.

Apply one of the two options at Settings → Integrations → Merge protection. See Blocking merges.

I applied the ruleset but the check still is not required

Check the name. There are two, and they belong to different setup paths:

Require the one matching the path you set up. Requiring both is fine.

The Merge protection card says "Configured", did Argus verify it?

No. That badge records that you marked the setup done, so the dashboard reminder stands down. Argus does not hold the permission needed to inspect your branch protection. Keep the ruleset under your own change control.

Credits and billing

"Out of credits"

Your balance hit zero. Options:

• Buy a top-up: Settings → Billing → Buy credits. Starter $5 / 100, Growth $20 / 500, Scale $50 / 1,500.
• Upgrade: Pro grants 1,000 credits a month, Team 5,000.
• Wait for the rollover: your plan's credits are granted when the 30-day period turns over. GetBilling returns periodEnd.

Deterministic scanning keeps working at zero credits, until your rule-scan quota runs out.

"Monthly rule-scan limit reached"

You have used your plan's rule-based scan allowance for this period. Free includes 10 per month; Pro and Team are unlimited. GetBilling returns ruleScansUsed and ruleScansLimit.

Where did my credits go?

Settings → Billing → Credit history lists every grant and spend, with the reference type and id, so each charge traces back to the exact scan, review or question. Or:

curl -sS -X POST "$ARGUS_URL/api/graphql" \
  -H "Authorization: Bearer $ARGUS_API_KEY" -H "content-type: application/json" \
  -d '{"query":"{ ListCreditLedger(page:1,limit:50){ entries { createdAt reason delta balanceAfter refType refId } } }"}'

Do I get charged when an AI call fails?

No. AI actions charge on success. If no provider is configured, or the call errors, nothing is deducted.

AI features

"AI features need a provider key"

Argus does not ship a model provider. Add one at Settings → AI Scan → AI provider key: OpenAI, Anthropic, or any self-hosted OpenAI-compatible endpoint (GLM, vLLM, Ollama).

The key is verified with a live read-only call before it is saved, stored encrypted, and only ever shown back masked.

Then switch Enable AI Scanning on.

The PR reviewer is not commenting on things the rules miss

Turn on Settings → AI Scan → AI security review on pull requests. Without it, PR review runs the deterministic engines and uses AI only to triage those results.

The toggle needs AI scanning enabled and a provider configured, and it saves the moment you flip it.

Can AI suppress a real critical finding?

No. AI triage can only demote, and only when the verdict is false positive and confidence is at least 0.7 and the severity is MEDIUM or below. CRITICAL and HIGH findings are never suppressed by AI.

Access and errors

"Your role (viewer) is not permitted to perform this action"

Every write is checked against a fixed permission matrix. A Viewer can read everything and change only their own preferences. Ask an Admin to change your role at Settings → IAM → Users, or to perform the action.

See the permission matrix.

My API key gets FORBIDDEN on a mutation that works in the UI

API keys authenticate as the machine principal, not as you. They can create projects, trigger scans, triage findings, import BOMs and use AI features, and nothing else. Deleting projects and changing settings, members, billing or keys are not available to a key by design.

Error codes

I lost my API key

Keys are shown once and stored hashed. There is no way to retrieve one. Revoke it at Settings → API keys and create a replacement.

Changing my password signed me out everywhere

By design. A password change immediately invalidates every other session. The tab you changed it in stays signed in.

Data and privacy

How long is my data kept?

180 days by default, configurable from 30 to 3650 at Settings → Priority weights → Data Retention. Records past the window are permanently deleted. There is no separate archive to restore from, Settings → Archive shows the current window, the cutoff and how many scan jobs are pending deletion.

Does Argus keep a copy of my source code?

No. A scan clones the repository into temporary storage, analyses it, and deletes the clone when the scan finishes. What is retained is the findings, the dependency inventory, the API and third-party inventory, and the BOMs.

Can one organization see another's data?

No. Every query and every mutation is scoped to the caller's organization. A project id from another organization returns "not found" rather than revealing that it exists.

Frequently asked

Is Argus a scanner or an ASPM platform? Both, and the difference matters. The scanners produce findings; the platform decides which ones are worth your time, tracks them to closure, gates your merges, and produces the artifacts your auditors ask for.

Can I use my own scanners' results? Import BOMs and VEX documents with ImportBOM and ImportVex. There is no generic finding-import endpoint today.

Does Argus auto-merge fixes? Never. The agent opens a pull request; a human reviews and merges it.

What is a "slopsquat"? A package name an AI coding assistant hallucinated, a plausible-looking lookalike or a package that does not exist. Attackers register those names and wait. scan_package verifies a package actually exists and checks for lookalike names before you install it.

Can I self-host? Private and on-prem deployment is part of the Enterprise plan. Contact sales.

How do I get a report for a stakeholder who does not use Argus? GET /api/report/<project-id> returns a complete standalone HTML report. For auditors, GET /api/compliance/<project-id>?framework=… returns a framework-mapped evidence pack. See API reference.

Still stuck

• Press ⌘J anywhere in Argus to ask the built-in assistant about your own data. It answers from your findings, and it will tell you when it does not know.
• The in-app Help page has a searchable version of these topics.
• For billing and enterprise questions, use Contact sales on the Billing page.