- Support
- FAQ
Questions, answered plainly
36 answers, reviewed with every release. Open one, or search.
36 questions
Getting started
6What does pinwise actually do?
pinwise reads the manifests and lockfiles of your repos, finds the dependency debt that matters (advisories, majors behind, deprecated packages, an end-of-life Node runtime) and turns it into tickets a coding agent can close. Your agent picks a ticket over MCP, makes the change in your repo, and reports evidence. We rescan the branch and close the ticket only when the lockfile proves the upgrade landed.
How do I connect my first repo?
Sign in, then install the read-only GitHub App on the repos you want tracked. The first scan starts as soon as the installation lands; the repo card on /app shows its progress and the Debt-free score when it is done. Private repos work the same way: the App only ever reads manifests and lockfiles.
The Free plan tracks one repo; paid plans track more and scan daily.
How long does the first scan take?
Usually under two minutes. A scan fetches the manifests and lockfiles at the default branch, resolves every package against its registry, checks advisories and the safe window, then writes tickets. Very large monorepos with several lockfiles take longer; the repo card keeps a live timer while the scan runs and reloads when it settles.
What is in a ticket?
A complete brief: the package, the current and target versions, why it matters (advisory, breaking notes, age), the research behind the target, the test rules the agent must follow and the exact evidence it has to submit. An agent with no other context should be able to execute it. Tickets are numbered TDB-0001 and up per workspace.
How do I point my coding agent at the queue?
pinwise is a remote MCP server. Create an API key under Settings → API keys, add the server to Claude Code, Cursor, Codex or Windsurf with the one-block config on the MCP setup page, and ask the agent to work the next ready ticket. MCP access is part of every paid plan.
What is the safe window?
The number of days a release must have been public before pinwise will target it: 14 days by default, adjustable between 7 and 30 per workspace under Settings. It keeps you off releases that get yanked or patched within their first week. A ticket always targets the newest release that is older than the window and clear of advisories.
Account
5I cannot sign in. What should I check?
Two ways in exist: Continue with GitHub and email (a one-time code). If GitHub sign-in loops back to the sign-in page, allow third-party cookies for pinwise.dev and try again; a sign-in link that was opened in another browser expires and must be started again. If you signed up with email and later installed the GitHub App, use the email sign-in and link GitHub from Settings. Still stuck? Use the contact form below: it works without an account.
I signed up with email. How do I connect GitHub?
Open Settings and choose Link GitHub. pinwise sends you through the GitHub sign-in once so it can verify that you are the person who installs the App, then brings you back. If GitHub says the identity is already linked to another pinwise account, sign in with GitHub instead: that account already owns the installation.
What is a workspace, and how do I add teammates?
A workspace holds repos, tickets, channels and billing. You get one when you sign up and can be a member of several (an agency with client workspaces, for example). Owners invite members from Settings → People; the invite lands in their inbox as a link. Member seats depend on the plan: one on Free and Solo, three on Studio, ten on Agency.
How do API keys work, and what if I lose one?
Keys start with pw_, are shown once when created and stored only as a hash, so a lost key cannot be recovered: revoke it and create a new one under Settings → API keys. Name keys per machine or agent so revoking is painless. Keys belong to the workspace and carry its plan; they never grant access to another workspace.
How do I delete my account or a workspace?
Uninstall the GitHub App to stop every scan immediately, then ask us to delete the account from the support form (category Account). We remove the workspace, its scans, tickets and keys and confirm by email. Billing stops with the deletion; there is nothing to cancel separately.
Billing
6Which plan do I need?
Free tracks one repo with a weekly scan and research on three tickets. Solo ($15/month) tracks five repos daily with MCP access, instant CVE alerts, two notification channels and PDF reports. Studio ($59) adds 25 repos, three seats, two-way channels to Jira, Linear and GitHub Issues. Agency ($149) covers 100 repos, ten seats, client workspaces and branded reports. Annual billing is two months free.
How do I upgrade, downgrade or switch to annual?
Open Settings → Plan and billing and choose Manage billing: it opens the billing portal where you can change plan, switch between monthly and annual, update the card and download invoices. Upgrades apply at once and are prorated; downgrades take effect at the end of the current period. Repos above the new limit are paused, not deleted, so you can pick which stay tracked.
Where are my invoices?
In the billing portal (Settings → Plan and billing → Manage billing), with a PDF per payment. Add your company name, address and VAT number there and they appear on every invoice from then on. Receipts are also emailed to the billing address at each charge.
Can I get a refund?
If pinwise did not do what we say it does, yes: tell us within 14 days of the charge and we refund it in full. For a change of mind on a monthly plan, cancel in the portal and the plan simply runs out at the end of the period. Annual plans refund the unused months on request within the first 30 days.
What happens when I hit the repo limit?
New installations beyond the limit are paused: the repo shows Paused by plan limit on its card and is not scanned until you remove another repo or upgrade. Nothing is lost; the first scan runs as soon as the repo is unpaused. Members, channels and research have the same behaviour: the feature is gated, never silently dropped.
I have a gift or invite code. Where do I use it?
Open the link you received, or sign in and paste the code under Settings → Plan and billing. A gift grants the plan it names for its term without a card; an invite code unlocks its offer at checkout. Codes are single-use and show their expiry before you redeem them.
Scans
6My scan looks stuck. What now?
A scan that has run for more than ten minutes is not going to finish: a registry timed out or a lockfile could not be parsed. Press Rescan on the repo page; the previous attempt is discarded. If the second run fails too, the repo card shows the reason (for example an unsupported lockfile). Send us the repo name and the time of the attempt and we look at the worker logs.
Which ecosystems and lockfiles are supported?
npm, pnpm and yarn lockfiles; PyPI (requirements.txt, poetry.lock, uv.lock); crates.io (Cargo.lock); Go modules (go.sum); the Node runtime from .nvmrc, .node-version or engines; and GitHub Actions pins in workflows. Manifests without a lockfile are listed for manual review because nothing can be verified without one.
How is the Debt-free score calculated?
It starts at 100 and loses points per finding: critical or high advisories cost the most (25 each, capped at 50), then moderate advisories, majors behind, minors behind, deprecated packages and an end-of-life Node runtime. The score can go below zero when the debt outweighs the scale. Bands: healthy from 80, drifting from 50, rotting from 0, critical below.
How often do you rescan, and can I trigger one?
Weekly on Free, daily on every paid plan, plus a rescan after each push to the default branch and whenever an agent completes a ticket (that one verifies the evidence). Rescan on the repo page queues one by hand; it is rate-limited to one per minute per repo so a stuck button cannot flood the queue.
What do you store from my repo?
Manifests, lockfiles and the scan results derived from them. Never source code: the GitHub App cannot read it, and pinwise has no use for it. Research summaries and advisories are public data. Public scanner reports expire after 90 days; connected repos keep their history while the repo stays connected.
What is the free public scanner, and can I remove my repo from it?
Anyone can scan a public GitHub repo at /scan without an account; the report is shareable and indexed. If you own a repo and prefer it not to appear, sign in with the GitHub account that owns it and use Remove from the public scanner on the report page; the page returns 410 within minutes and never comes back unless you ask.
Integrations
5My agent cannot connect to the MCP server.
Check three things: the server URL ends in /mcp, the key is sent as Authorization: Bearer pw_… (or you chose OAuth and finished the browser step), and the key has not been revoked. A 401 means the key is wrong or revoked; a 403 means the workspace plan has no MCP access (Free). Restart the agent after editing its config: most of them read it once at start.
My agent completed a ticket but it did not close.
A ticket closes only when a rescan of the reported ref shows the installed version at or above the target with no advisories. Common causes: the lockfile was not committed, the change is on a branch that was not pushed, or the manifest moved but the lockfile still pins the old version. The ticket page shows what the rescan saw; fix the ref and call complete_ticket again.
How do ticket channels work?
A channel pushes the tickets you choose (per repo, lane and priority) to a destination: Slack, Discord, Teams, email, a webhook, or a tracker like Jira, Linear and GitHub Issues. Trackers talk back: closing the issue there marks the ticket closed externally, awaiting verification; the pinwise ticket still only closes when a rescan proves it. Solo gets two notification channels; Studio and Agency get two-way tracker channels.
A channel shows "stopped" or "failing". How do I fix it?
Open the channel from Settings → Where tickets go. Retrying means a delivery failed and will be tried again on a backoff; failing means several in a row failed; stopped means pinwise paused it after the destination kept rejecting (a revoked token, a deleted Slack channel, a 4xx from your webhook). The channel page shows the last error, redacted. Reconnect or fix the destination, then press Resume; dead deliveries can be retried one by one.
How do I verify webhook signatures?
Every webhook delivery carries X-Pinwise-Signature: an HMAC-SHA256 of the raw body with the channel’s signing secret, plus a timestamp header to reject replays. Compare in constant time and ignore deliveries older than five minutes. Node and Python examples are on the channels page, with the exact header names and the retry schedule.
Bugs
3How do I report a bug, and what should I include?
Open a support request with the category Bug and link the repo or ticket it concerns; the form offers both pickers. Include what you expected, what happened, the time (with timezone) and, for agent problems, the tool call and its response. We answer by email and keep the thread in Help → My requests so you can add details later.
A ticket targets the wrong version or a package we do not use.
Targets come from the registry and the safe window: the newest release older than the window with no advisories. If a target looks wrong, check the window (Settings) and whether the package is a transitive dependency pinned by the lockfile; tickets name the direct dependency that pulls it in. A package you really do not use at that path is a bug: report it with the ticket id and we correct the parser.
I found a security issue. Where do I report it?
Not in a public place, please. Email security@pinwise.dev with steps to reproduce; you get a human answer within two working days and credit if you want it. The security page lists what the GitHub App can and cannot read, how secrets are stored and the retention rules.
Sales
3Can I try a paid plan before paying?
The Free plan is the trial: one repo, a weekly scan and research on three tickets, for as long as you like. If you need to evaluate MCP or channels on a real team repo first, open a request with the category Sales and say which repo and for how long; we can switch a workspace to Solo or Studio for a couple of weeks without a card.
We are an agency. Can we keep client repos apart?
Yes: the Agency plan adds client workspaces, each with its own repos, tickets, channels and members, under one bill. Reports can carry your brand. Clients can be invited into their own workspace without seeing the others.
Can we pay by invoice, or sign a DPA or security questionnaire?
Annual Studio and Agency plans can be paid by invoice (bank transfer, net 30). A data processing agreement is available on request, and the security page answers most questionnaires: read-only GitHub access, manifests and lockfiles only, no source code stored. Open a request with the category Sales and we send the paperwork.
Other
2How do I contact support, and how fast do you answer?
Signed in: Help → Contact support opens a request linked to your workspace, and you follow the thread under My requests. Not able to sign in: the contact form on this site works without an account. Every request is read by a person; we answer by email, usually within one working day. Urgent production problems: say so in the subject.
Can I request a feature or a new ecosystem?
Please do. Open a request with the category Other and describe the workflow, not just the feature: what you are trying to get done tells us far more. We reply with whether it is planned, and the changelog on /app shows what shipped.
Nothing matches that search.Try fewer words, or ask us directly below.