OMCHOKSI108 · OMCHOKSI108 · Jun 22, 2026 · Jun 22, 2026
diff --git a/.gitignore b/.gitignore
@@ -3,6 +3,9 @@
 .env
 .env.*
 kaggle.json
+secrets/
+*.pem
+github_app_credentials.local.json
 
 # release temp files
 release/

diff --git a/README.md b/README.md
@@ -17,12 +17,16 @@ CodeSecAudit AI acts like an AI senior engineer inside GitHub pull requests, det
 ## Live Links
 
 | Asset | Link |
-|---|---|
+|---|---|---|
 | Kaggle Notebook | https://www.kaggle.com/code/omchoksi04/codereview |
 | Hugging Face Dataset | https://huggingface.co/datasets/OMCHOKSI108/CodeSecAudit-RAG |
 | RAG Service (live) | https://OMCHOKSI108-codereview-agent.hf.space |
+| API (live) | https://codesec-api.onrender.com |
+| Dashboard (live) | https://codesec-dashboard.onrender.com |
+| Review UI (live) | https://codesec-review-ui.onrender.com |
 | GitHub Repo | https://github.com/OMCHOKSI108/codesec-audit-dataset |
 | Deploy PR | https://github.com/OMCHOKSI108/codesec-audit-dataset/pull/1 |
+| Website (coming soon) | https://codesec-website.onrender.com |
 
 ---
 
@@ -156,6 +160,27 @@ docker compose up --build
 
 See [docs/docker.md](docs/docker.md) for RAG mode and build options.
 
+### SaaS Website (Flask)
+
+```bash
+pip install -e ".[website]"
+flask --app website.app run --port 5000
+# Open http://localhost:5000
+```
+
+See [docs/website.md](docs/website.md) for env vars and deployment.
+
+### GitHub App Setup
+
+```bash
+python scripts/create_github_app_manifest.py
+# Open the URL → create app → run:
+python scripts/complete_github_app_manifest.py --code YOUR_CODE
+python scripts/apply_github_app_env.py --write
+```
+
+See [docs/github_app_setup.md](docs/github_app_setup.md) for full instructions.
+
 ---
 
 ## GitHub Action Usage
@@ -274,7 +299,7 @@ The user flow for the SaaS version:
 6. Limit reached → Resend email with upgrade prompt
 7. Contact owner for custom plans
 
-Owner contact: **omchoksi108@gmail.com**
+Owner contact: [omchoksi108@gmail.com](mailto:omchoksi108@gmail.com)
 
 Current status:
 - [x] Datasets + RAG corpus
@@ -311,4 +336,4 @@ CodeSecAudit AI is a **defensive security tool**:
 
 For questions, custom plans, or limit increases:
 
-**omchoksi108@gmail.com**
+[omchoksi108@gmail.com](mailto:omchoksi108@gmail.com)
diff --git a/deploy/render/website.Dockerfile b/deploy/render/website.Dockerfile
@@ -0,0 +1,17 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY pyproject.toml README.md ./
+COPY review_engine/ review_engine/
+COPY website/ website/
+COPY config/ config/
+
+RUN pip install --no-cache-dir -e ".[website]"
+
+COPY deploy/render/website_start.sh /website_start.sh
+RUN chmod +x /website_start.sh
+
+EXPOSE 10000
+
+CMD ["/website_start.sh"]
diff --git a/deploy/render/website_start.sh b/deploy/render/website_start.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -e
+
+echo "Starting CodeSecAudit Website..."
+exec gunicorn website.app:app --bind 0.0.0.0:${PORT:-10000} --workers 2 --timeout 60 --access-logfile -
diff --git a/docs/github_app_setup.md b/docs/github_app_setup.md
@@ -0,0 +1,146 @@
+# GitHub App Setup
+
+CodeSecAudit AI uses the **GitHub App Manifest flow** to create its GitHub App without manually filling every field in the GitHub UI.
+
+---
+
+## Prerequisites
+
+- Python 3.10+
+- `requests` library (`pip install requests`)
+- A GitHub account
+
+---
+
+## Quick Setup
+
+### 1. Generate the manifest
+
+```bash
+python scripts/create_github_app_manifest.py
+```
+
+This prints a URL. Open it in your browser.
+
+> For an organization, use:
+> ```bash
+> python scripts/create_github_app_manifest.py --org YOUR_ORG_NAME
+> ```
+
+Required callback/webhook URLs can be passed as args:
+
+```bash
+python scripts/create_github_app_manifest.py \
+  --callback-url https://your-website.onrender.com/auth/github/callback \
+  --webhook-url https://your-api.onrender.com/webhook/github
+```
+
+Or set env vars:
+
+```bash
+export GITHUB_CALLBACK_URL=https://your-website.onrender.com/auth/github/callback
+export GITHUB_WEBHOOK_URL=https://your-api.onrender.com/webhook/github
+```
+
+### 2. Create the app in GitHub
+
+1. Open the printed URL in your browser.
+2. Review the pre-filled fields.
+3. Click **"Create GitHub App"**.
+4. GitHub redirects to the `redirect_url` with a `?code=...` parameter.
+5. Copy the `code` value from the URL.
+
+### 3. Exchange the code for credentials
+
+```bash
+python scripts/complete_github_app_manifest.py --code YOUR_TEMP_CODE
+```
+
+This:
+
+- Calls `POST /app-manifests/{code}/conversions`
+- Saves credentials to `secrets/github_app_credentials.local.json`
+- Prints the App ID, slug, and Client ID
+- Shows safe `.env` template
+
+### 4. Apply credentials to `.env`
+
+Dry-run first:
+
+```bash
+python scripts/apply_github_app_env.py
+```
+
+To write:
+
+```bash
+python scripts/apply_github_app_env.py --write
+```
+
+This sets:
+
+```text
+GITHUB_APP_ID
+GITHUB_APP_SLUG
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+GITHUB_WEBHOOK_SECRET
+GITHUB_PRIVATE_KEY_BASE64
+```
+
+### 5. Verify
+
+```bash
+python scripts/verify_github_app_env.py
+```
+
+---
+
+## Permissions
+
+| Permission | Level | Why |
+|------------|-------|-----|
+| **Contents** | Read | Read PR file contents for review |
+| **Pull requests** | Read & write | Post summary comments and inline review comments |
+| **Issues** | Read & write | Post review results as issue comments |
+| **Checks** | Read & write | Create check runs for status visibility |
+| **Metadata** | Read | Access repo metadata for PR context |
+
+## Events
+
+| Event | Why |
+|-------|-----|
+| **Pull request** | Trigger review on `opened` and `synchronize` |
+| **Installation** | Track which repos the app is installed on |
+| **Installation repositories** | Track repo additions/removals |
+
+## Security
+
+- **Never commit** the private key (`.pem` file)
+- **Never commit** `.env`
+- **Never commit** `secrets/github_app_credentials.local.json`
+- Keep the webhook secret private
+- Store secrets in Render environment variables (not in the repo)
+
+## Render Deployment
+
+Set these env vars on your Render services:
+
+| Variable | Service | Description |
+|----------|---------|-------------|
+| `GITHUB_APP_ID` | API, Website | GitHub App numeric ID |
+| `GITHUB_APP_SLUG` | Website | App slug for install button URL |
+| `GITHUB_CLIENT_ID` | Website | GitHub OAuth Client ID |
+| `GITHUB_CLIENT_SECRET` | Website | GitHub OAuth Client Secret |
+| `GITHUB_WEBHOOK_SECRET` | API | Webhook secret for payload verification |
+| `GITHUB_PRIVATE_KEY_BASE64` | API | Base64-encoded App private key |
+| `GITHUB_CALLBACK_URL` | Website | Full callback URL (`https://website/auth/github/callback`) |
+| `GITHUB_WEBHOOK_URL` | API | Full webhook URL (`https://api/webhook/github`) |
+
+---
+
+## Next Steps
+
+- GitHub App webhook review processing is the next backend phase
+- The manifest scripts handle **registration only**
+- Install the app on a repo after creation to enable webhook delivery
diff --git a/docs/website.md b/docs/website.md
@@ -0,0 +1,79 @@
+# CodeSecAudit AI — SaaS Website
+
+Flask-based marketing site + dashboard with GitHub OAuth login.
+
+---
+
+## Local Run
+
+```bash
+pip install -e ".[website]"
+flask --app website.app run --port 5000
+# or
+python -m website.app
+```
+
+Open http://localhost:5000
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `CODESEC_API_URL` | No | FastAPI backend URL (default: `http://localhost:8000`) |
+| `PUBLIC_WEBSITE_URL` | No | Public website URL (default: `http://localhost:5000`) |
+| `GITHUB_CLIENT_ID` | For OAuth | GitHub OAuth App client ID |
+| `GITHUB_CLIENT_SECRET` | For OAuth | GitHub OAuth App client secret |
+| `GITHUB_CALLBACK_URL` | No | OAuth callback (default: `<PUBLIC_WEBSITE_URL>/auth/github/callback`) |
+| `SESSION_SECRET` | For production | Flask session secret key |
+| `GITHUB_APP_SLUG` | No | GitHub App slug for install button |
+| `MONGODB_URI` | No | MongoDB connection string |
+| `MONGODB_DB_NAME` | No | MongoDB database name (default: `codesec_audit`) |
+| `RESEND_API_KEY` | No | Resend API key for welcome emails |
+| `EMAIL_FROM` | No | From address for emails |
+| `OWNER_CONTACT_EMAIL` | No | Contact email (default: `omchoksi108@gmail.com`) |
+| `FREE_PR_REVIEWS_PER_MONTH` | No | Free plan limit (default: `30`) |
+
+## GitHub OAuth Setup
+
+1. Go to **Settings → Developer settings → OAuth Apps → New OAuth App**
+2. Fill:
+   - Application name: `CodeSecAudit AI (Dev)`
+   - Homepage URL: `http://localhost:5000` or your Render URL
+   - Authorization callback URL: `http://localhost:5000/auth/github/callback` or your Render URL
+3. Copy `Client ID` and `Client Secret`
+4. Set as `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET` env vars
+
+## Render Deployment
+
+1. Create a new **Web Service** in Render dashboard
+2. Connect your repo
+3. Set:
+   - **Name:** `codesec-website`
+   - **Region:** same as API
+   - **Branch:** `main`
+   - **Runtime:** Docker
+   - **Dockerfile path:** `deploy/render/website.Dockerfile`
+   - **Health Check Path:** `/`
+4. Add all env vars from the table above
+5. Deploy
+
+Or use the `render.yaml` blueprint for automated setup.
+
+## MongoDB Behavior
+
+- If `MONGODB_URI` is set and reachable: user profiles are stored in MongoDB `users` collection
+- If MongoDB is unavailable/unconfigured: in-memory dict fallback (lost on restart)
+- Website never crashes due to DB issues
+
+## Resend Welcome Email
+
+- If `RESEND_API_KEY` is set: welcome email sent on first sign-in
+- Email uses Resend HTTP API directly (no SDK needed)
+- If email fails, login still succeeds (logged warning)
+
+## Limitations
+
+- Usage enforcement is **display-only**; actual limit checking is next step
+- GitHub App install button appears if `GITHUB_APP_SLUG` is set; no webhook yet
+- No account settings persistence (coming in next iteration)
+- Review history depends on FastAPI backend availability
diff --git a/pyproject.toml b/pyproject.toml
@@ -32,8 +32,13 @@ rag = [
     "chromadb>=0.5.0",
     "sentence-transformers>=2.2.0",
 ]
+website = [
+    "flask>=3.0.0",
+    "requests>=2.31.0",
+    "gunicorn>=22.0.0",
+]
 dev = [
-    "codesec-audit-ai[api,ui,rag]",
+    "codesec-audit-ai[api,ui,rag,website]",
 ]
 
 [tool.hatch.build]

diff --git a/render.yaml b/render.yaml
@@ -0,0 +1,35 @@
+services:
+  - type: web
+    name: codesec-website
+    runtime: docker
+    repo: https://github.com/OMCHOKSI108/codesec-audit-dataset
+    branch: main
+    dockerfilePath: ./deploy/render/website.Dockerfile
+    healthCheckPath: /
+    envVars:
+      - key: CODESEC_API_URL
+        value: https://codesec-api.onrender.com
+      - key: PUBLIC_WEBSITE_URL
+        value: https://codesec-website.onrender.com
+      - key: GITHUB_CLIENT_ID
+        sync: false
+      - key: GITHUB_CLIENT_SECRET
+        sync: false
+      - key: GITHUB_CALLBACK_URL
+        value: https://codesec-website.onrender.com/auth/github/callback
+      - key: SESSION_SECRET
+        generateValue: true
+      - key: GITHUB_APP_SLUG
+        sync: false
+      - key: MONGODB_URI
+        sync: false
+      - key: MONGODB_DB_NAME
+        value: codesec_audit
+      - key: RESEND_API_KEY
+        sync: false
+      - key: EMAIL_FROM
+        sync: false
+      - key: OWNER_CONTACT_EMAIL
+        value: omchoksi108@gmail.com
+      - key: FREE_PR_REVIEWS_PER_MONTH
+        value: "30"