Members and roles
Add a member
Workspace Settings > Members > Add Member: enter a work email, pick a role, and pick a team or the orgs and repositories they may see. They can sign in at once with a one-time code sent to that email; there is nothing to accept.
Every member is a paid seat, whatever their role, and also gets Pro on their own machine for the workspace's products. People who only read results do not need a seat: send them scheduled report emails.
Built-in roles
| Role | Can |
|---|---|
| Owner | Everything, including deleting the workspace and changing owners. |
| Maintainer | Run the workspace: members, roles, settings, notifications, every org. |
| Org Admin | Connect and configure their orgs, scan, export, approve triage. Rule changes need approval. |
| Security Analyst | See everything in their orgs, scan and export. |
| Developer Admin | Developer pages plus org posture; scan; approve or reject triage. |
| Developer | Code findings, code graph, impact, quality, issues, attack paths; propose triage. |
| Auditor | Read-only: overview, issues, compliance, readiness, licences, activity. Can export. |
| Viewer | Read-only. Cannot see the Data pages, Identity & Access user details, notification destinations or settings. |
Custom roles
Copy any built-in role except Owner, then set Page access (None, View or Manage) per page and the Actions: submit or approve triage, submit or approve rule changes, write custom rules, connect the CLI, allow support access.
Scope and teams
A member sees every org and repository, a list of them, or one team. A team (Workspace Settings > Teams) groups orgs and repositories and also narrows Issues, home views, reports and dashboards.
Home views
Each role opens on a home view, set in Workspace Settings > Roles. It changes the home page and menu, never what a member is allowed to see.
| View | For | Default for |
|---|---|---|
| Executive | Risk and trend in plain words | Owner, Viewer |
| Security | Proven, exposed and overdue issues first | Org Admin, Security Analyst |
| Engineering | Every page in the menu | Maintainer, Developer Admin, Developer |
| Compliance | Readiness, failing controls, evidence | Auditor |
Sign-in controls
Workspace Settings > Sign-In & Security:
- Multi-Factor Authentication for every member.
- Allowed Email Domains.
- Session Timeout: idle (15 minutes to 7 days) and absolute (1 hour to 30 days).
- IP Allowlist: up to 100 ranges, applied to API tokens too.
- Single Sign-On (SAML or OIDC): Business and up, set up by our team.
Every change is in the activity log; exporting it is on Business and up.