Low, balanced, max
Every workflow ships with three profiles. What each one changes, how the price is computed, and when each is the right choice.
A workflow says how to audit. A profile says how hard to try. The same workflow on low and on max reads the same instructions and reaches very different depths at very different prices, and choosing between them is the main decision you make before a run. This post is the manual.
What a profile sets
Three things, all of them in the workflow's manifest and all of them visible before you run.
The models. low uses fast models — the ones that answer in seconds and are good at the obvious. balanced uses leading models. max uses the strongest models available for the task. The exact model and version are shown on the pre-run screen and recorded on the run.
The depth. low makes one pass through the scope. balanced makes two, and verifies each candidate finding before reporting it. max makes repeated passes, verifies everything, and spends its budget chasing the findings that are hardest to confirm.
The budget. Each profile carries a cap on model spend and a time limit — an hour on low and balanced, two on max. A run that reaches its cap stops, reports what it has, and says on the report that it stopped early.
How the price is computed
Every run costs a whole number of credits, and the number is shown before you start. The workflow's manifest carries a base price per profile — what the bench measured the run to cost on a mid-sized repository. The app scales that for the size of yours, and again if you change anything: a stronger model, another pass, a narrower scope, a lower cap. The figure updates as you edit; what you see is what you are charged.
One credit is one dollar. A first pass on low is typically a few credits. A balanced audit of a mid-sized repository is typically several. A max run is typically a dozen or two. Those are typical figures for typical repositories; the app shows the exact one for yours.
Runs that fail before analysis begins are not charged. Runs that stop early are charged for what ran, and the invoice says so.
When to use which
low is for pull requests, triage and first looks. It is fast enough to run on every change and cheap enough that nobody has to think about it. It will find the injection in the diff. It will not trace the authorisation gap three files away.
balanced is the default for a reason: it verifies before it reports, and it is the right depth for a repository audit you will read carefully. If you run one workflow on a repository once, run it here.
max is for the runs you sign your name to: a release audit, a bounty target, a repository you have already run on balanced and want to squeeze. It is the profile most likely to produce a finding with a proof you can hand to someone. It is also the one where the price is worth reading twice.
Tweaking
Profiles are starting points, not tiers. Change the model, raise or lower the passes, narrow the scope to one service, cap the budget at what you are willing to spend. The pre-run screen re-prices as you go. A tweaked profile is recorded on the run exactly as it ran, so a colleague can reproduce it — and on Team, you can save it as a private fork of the workflow and run it again next month.