Rate limits

Andesyte Code Security applies a small set of caps to keep the free tier sustainable and protect against runaway CI loops. Paid plans have materially higher fair-use limits. Real engineering teams on a paid plan should not hit them in normal use.

What's capped

There are four independent counters: monthly per repo, monthly per account, daily per install and daily per code review. Free applies a cap on all four; paid plans lift the monthly caps entirely and apply much higher daily caps. Current numbers for your plan are shown on the usage page.

What each cap does

• Monthly per repo (Free only). Hit it on a busy repo and that repo's audits pause until the next month; other repos keep running.
• Monthly per account (Free only). Applies across all repos in your account per calendar month. Andesyte keys this to your stable GitHub account id, not to the install. Uninstalling and reinstalling the App does not reset the counter.
• Daily per install (every plan). Bounds the worst-case daily spend if a runaway CI loop opens hundreds of code reviews.
• Daily per code review (every plan). Stops a single code review with a push-rebase loop from consuming the whole install daily budget. Other code reviews on the install keep running unaffected.

Free-of-charge protections (no cost regardless of plan)

These are infrastructure-level. They never cost you a finding and never count against any cap:

• Draft code reviews are skipped. The first audit fires when you mark the code review ready for review.
• Bot-authored code reviews (Dependabot, Renovate, etc) are skipped by default.
• Same-commit redelivery (GitHub webhook retries, no-op force pushes) is deduplicated. If we audited a commit once, we won't audit the same head_sha again for a short window.

Reset cadence

Monthly counters reset at the start of each calendar month; daily counters reset once per UTC day. All boundaries are fixed regardless of your timezone.

When you hit a limit

• The code review comment is replaced with a single line explaining which cap was hit and (for Free) linking to the pricing page.
• The audit attempt is logged so you can see it in the usage page.
• No charge, no email, no error in the GitHub code review. Andesyte just stops commenting on that code review for the rest of the window.
• Audits resume automatically when the relevant counter resets.

If you are hitting a cap and need more headroom before the reset, upgrade your plan from the billing page. The new caps take effect immediately.

Need a higher ceiling?

The paid daily caps are fair-use guardrails, not product quotas. Teams on a paid plan can request higher ceilings via contact; we will normally lift them the same day after a quick chat about your expected code review volume.