Audit setup options

When you start a code audit from Code Audits → New audit, the wizard goes beyond picking a branch. These options shape what Guardix reads and how much of the repository is in scope.

Contract scope

By default, Guardix selects auditable Solidity contracts automatically from your snapshot. You can switch to manual selection to:

• Limit the run to specific contracts (faster, narrower scope).
• Exclude vendor, mock, or test-only paths you do not want in the report.

Manual mode shows a file tree of contract candidates at the chosen ref. At least one contract must remain selected.

Additional documentation

The Additional documentation step lets you attach context the pipeline cannot infer from code alone:

Source type	Examples
External URLs	Notion sites, GitBook, public docs pages — Guardix can map reachable pages before the run.
Pasted text	Threat models, rollout notes, known limitations.
Repository docs/ folders	When present, Guardix can include markdown from standard doc paths in the repo.

Documentation is optional but improves architecture understanding and reduces false positives when your design intent is documented elsewhere.

Source archive upload (optional)

Some workspaces support auditing from a ZIP source archive instead of (or in addition to) a GitHub connection — useful for private drops that are not in a connected repo. When available, choose Upload archive in the source step and provide a ZIP within the size limit shown in the UI.

For ongoing Git-based workflows, connecting the repository is usually simpler; archives suit one-off or air-gapped handoffs.

Review step

The final Review screen summarizes repository, ref, contract scope, documentation sources, and pricing before checkout. Confirm everything matches the snapshot you intend to stand behind externally.

Related

• Connecting repositories
• Your first audit
• Open questions — follow-up context during or after the run