Organization settings

4 min

, , , ,

Organisation settings apply to every repository, unless a repository’s .hacktron/config.yaml overrides them. Only organisation admins and owners can change them.

To open them, select your organisation, then go to Settings.

Scan filters

Scan filters choose which pull and merge requests Hacktron scans by default. They come in four categories: branches, labels, authors, and keywords.

Find the Filters card

Find Filters.

Add a filter

Select Add filter. Choose a category and a direction, then enter one or more values.

The Filters card, with a branch filter that includes release/*

Each category matches in its own way:

Category	Match style
Branches	Glob pattern, case-insensitive, such as `release/*`
Labels	Exact name, case-insensitive
Authors	Glob pattern, case-insensitive, such as `*-bot`
Keywords	Substring of the PR/MR title, case-insensitive

Note

You can set both Include and Exclude for the same category, and Exclude takes priority within that category. A filter in one category has no effect on the others.

For control over a single repository, override any category in .hacktron/config.yaml. Repository configuration covers the glob syntax, the limits, and how repository configuration overrides the organisation’s defaults.

Check gate

The check gate is an organisation-wide severity. When a finding on a pull or merge request meets or exceeds it, the Hacktron check fails. To block the merge as well, make the Hacktron check required in your source control’s branch protection.

Find Minimum severity

Under Review defaults, find Minimum severity.

Review defaults, with Minimum severity set to Off

Choose a severity

Pick a severity: Critical, High, Medium, or Low. Select Off to turn the gate off for the whole organisation.

Fail the check on findings has the full severity table and the overrides for each repository.

Code review comments

This setting decides whether Hacktron posts scan results as comments on your pull and merge requests. It applies to every repository in your organisation and is on by default.

To change it, open Code review comments in Settings. Only organisation admins can change this setting.

Code review comments, with Post comments to source control and Post system comments turned on

With comments on, Hacktron posts findings and scan summaries directly to your pull and merge requests.

With comments off:

Scans run as normal.
Check statuses update and can block a merge.
Findings are available in Hacktron and in connected tools such as Slack, Jira, and Linear.
Hacktron posts no findings, summaries, or other comments to the pull or merge request.

Turning comments off doesn’t remove the comments Hacktron has already posted.

Post system comments

Post system comments posts notices about skipped reviews, usage limits, and configuration problems. It is on by default.

Turn it off to silence these notices. Finding comments and check statuses are not affected.

This option is unavailable while Post comments to source control is off, since that stops all pull and merge request comments.

SLA thresholds

SLA thresholds set the resolution window and the minimum compliance target for each severity.

Find the SLA Thresholds card

Find SLA Thresholds.

SLA thresholds, with days and a target percentage for each severity

Set days and a target for each severity

For each severity, set the number of days findings have to be resolved in, and the minimum percentage of findings that should meet that window.

These values drive the Resolution Health widget on the dashboard, including mean time to resolution (MTTR) and SLA compliance.

Repository configuration uses .hacktron/config.yaml to override the scan filters and the check gate for one repository.

Setup Repository configuration