Ozone by Docs

Getting started

From zero to your first security review takes a few minutes. You'll need a GitHub repository you can install apps on. In a shared Ozone team, an owner or admin performs the GitHub installation and repository connection; members can use repositories once they are connected.

1. Sign in#

Open Ozone and sign in with GitHub or Google. There is nothing else to set up — your workspace appears on first sign-in. Eligible teams get $100 of review credit for 30 days when they connect their first repository. No card required — add payment details to keep going after it is used or expires.

2. Install the GitHub App#

The onboarding flow walks you through installing the Ozone GitHub App on your GitHub account or organization. You choose which repositories it can see — all of them, or a hand-picked list. Ozone only ever acts on repositories you connect yourself in the next step.

If you signed in with Google, link a GitHub identity first: onboarding shows Connect GitHub & choose repositories in place of the install button until you do.

If your GitHub organization requires owner approval for new apps, the install becomes a request; come back and finish onboarding once an owner has approved it.

A GitHub organization connects to one Ozone team. If it is already connected to a team you belong to, onboarding offers Continue in {team} to switch there — and advances by itself when that team is already the one you're in. If you don't belong to it, you can request access instead of creating a duplicate workspace.

3. Connect a repository#

Pick the repository you want reviewed. That creates your first project — the unit that findings, schedules, and knowledge hang off. The first connection deliberately makes one project for one repository; later, add related repositories under Repositories & settings on the project page when you want the agent to analyse them together. Each repository belongs to exactly one project.

A new project also arrives with Continuous maintenance switched on — one built-in task that triages open findings and keeps project knowledge current. It runs at most once a day, and only when your code or findings have actually changed. Pause it under Schedules if you'd rather not pay for it yet.

4. Get your first review#

Onboarding ends on Launch analysis. It runs the /security-analysis skill across the repository — a first-principles audit that maps your trust boundaries and probes each surface, rather than reading a diff. It's the baseline to have before the PR-by-PR flow takes over, though it's never a gate: Skip for now goes straight to the project.

This one takes a while: up to four hours. You don't have to sit and watch — Ozone emails you when it lands, though the run page shows every file the agent reads, every search it runs, and every finding as it arrives.

To see the PR flow instead, open a pull request in GitHub and Ozone reviews it within a few minutes. To aim a run at a PR that's already open, ask the assistant to review it or use the API or MCP.

What happens on every PR from now on#

With the default settings, every pull request that opens (or gets new commits) in a connected repository is reviewed automatically. The result is:

  • A PR comment — one sticky comment that appears as review in progress the moment the review starts, then updates in place with findings by severity and Mark resolved / Ignore links. Those links ask you to sign in to Ozone as a member of the finding's team.
  • An Ozone security review check on the pull request, which admins can make required for protected branches. Ozone is a GitHub App rather than a GitHub Action, so this check burns none of your CI minutes and nothing appears in the Actions tab.
  • Dashboard findings — the same findings with full detail and discussion threads. Use Copy fix instructions on the review to hand the repair work to a coding agent.

Draft PRs are skipped by default, and pull requests from external forks are never reviewed automatically — a maintainer can request a review by commenting @ozone review. Tune all of this per repository in Projects & repositories.

Next steps#

  • Set trigger rules so bots, docs-only changes, or specific branches do not consume review capacity or credit.
  • Add knowledge about your conventions so reviews get sharper.
  • Meet the assistant — press ⌘K anywhere in the app.