Why did my scan cover less of my codebase than expected?

Why this happens

The scan agents read your code through the AI credential you connected. A token from a code-assistant subscription has tight rate limits. The page itself warns: such a token "can be throttled part-way through a scan, so the agents cover less of the codebase."

Nothing fails. The run finishes and the report looks normal, but the agents read less than they would with an API key, because the provider slows them down part-way through the work. You may see fewer findings than you hoped for, and the lines-of-code count on the scan page can look low for the size of your repository.

How to fix it

1. Open Settings and choose AI Provider.
2. Look at Provider type. If it shows the OAuth token option, that is the likely cause.
3. Select the API key option for your provider and paste the key into Replace credential.
4. Press Save credential, then Verify.
5. Start the scan again. On the scan page, compare the lines of code analysed with the earlier run.

Still not working?

• Check that the profile does not narrow the scan. Focus rules and the vulnerability classes you tick both limit what the agents test. See how to pick vulnerability classes.
• Make sure the repository URL points at the branch you expect.
• Read API key versus OAuth token for the difference.

If the numbers still look wrong, contact us at /contact and name the scan.

Related questions

• I picked a premium model, but the results aren't any better. Why?
• Should I use an API key or a subscription OAuth token for my AI provider?
• How do I use my organization's own AI provider key?
• What are the Deep analysis, Recon & exploitation and Lightweight tasks tiers?
• Why are my scans paused until next month?

Full tutorial

AI provider settings: included allowance, your own credential and models

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre