Billing and limits

Running a review is gated so that only entitled organizations can consume it. Reading past reports is not gated beyond normal authentication.

Subscription paywall

Triggering a review requires the organization to have an active subscription. Allowed subscription states are active, trialing, and past due. Without one, the trigger returns 402 Payment Required and no review runs.

This is enforced at the trigger boundary, so it applies to the API, the webhook, and the daemon alike.

Token quota

If the organization has a token quota for the billing period, it is checked before a review is queued. When the quota is exhausted, the trigger returns 402 Payment Required.

Daily review cap

On top of the subscription, each organization has a rolling 24-hour cap on the number of reviews. This stops a single valid subscription from being used to run an unbounded number of reviews. When the cap is reached, the trigger returns 429 Too Many Requests.

Configure the cap with SECURITY_REVIEW_DAILY_LIMIT. The default is 50, and 0 disables it.

Enforcement can be turned off

Billing enforcement follows the platform setting. When enforcement is disabled, for example in development, the subscription and quota checks are skipped. The daily review cap still applies.

What is not gated

Listing and fetching stored reports requires only an authenticated, organization-scoped user. Reports are always scoped to the caller’s organization, so one organization can never read another’s reports.