CodeRabbit Security

| CodeRabbit Security brings repository-level security analysis to CodeRabbit. Advanced and Enterprise include continuous pull request security review and its supported outputs, including Security Architecture Review and Security Blast Radius. AI Deep Scan is a separately metered scan that analyzes committed source code and infrastructure configuration for exploitable vulnerabilities and exposed secrets beyond the current pull request diff. AI Deep Scan results, including secret findings, appear under Security > Findings, where you can inspect evidence, triage findings, export results, and start supported fixes. These findings are separate from Security > PR security reviews, which come from security issues raised during pull request reviews. The Attack surface map organizes security-relevant code into subsystems and tracks verification coverage, findings, and drift as pull requests merge.

​

Security capabilities at a glance

AI Deep Scan does not perform dependency or software composition analysis (SCA) or generate a software bill of materials (SBOM).

​

PR security reviews

Open PR security reviews under Security or Analytics to review security issues raised during pull request reviews. Each finding shows its status and severity, plus separate Reachability and Exploitability badge columns. On GitHub Cloud and GitHub Enterprise Server, you can also enable the CodeRabbit Security check for individual repositories and require it before merging. Publication is off by default, and the default blocking threshold is Critical.

​

PR security reviews filters

Use the PR status filter to show All, Open, Merged, or Closed pull requests. Author is a searchable multi-select filter for choosing one or more pull request authors. Its menu continues to list all authors while filters are active, so you can switch authors without first clearing the current selection. Filters apply to the full organization-wide PR security reviews result set before pagination, and the reported total reflects the filtered set. Changing either filter returns the list to page one and closes any open pull request detail. The PR status filter describes the lifecycle of a pull request. It is separate from the status of each individual security finding. If an active filter returns no results, PR security reviews shows No pull requests match these filters. This is distinct from the existing empty state shown when the organization has no security findings from pull request reviews.

​

Reachability tiers

​

Exploitability tiers

A dash means no valid tier was available from the live provider review comment. This can happen for older findings or provider responses without the enriched comment body.

​

Before you start

​

Supported providers

• GitHub Cloud and GitHub Enterprise Server
• GitLab Cloud and self-hosted GitLab
• Azure DevOps Services
• Bitbucket Cloud and Bitbucket Data Center

​

Unsupported providers

• Azure DevOps Server (ADO Server)

Repository security settings, code context links, and Fix with AI are available on all supported providers. Custom scan branches and recurring AI Deep Scan schedules are currently available only for GitHub repositories. Linked repository source access for AI Deep Scan is available on GitHub Cloud, GitHub Enterprise Server, and GitLab Cloud. Its platform and plan requirements are separate from those for scanning a single repository.

​

Access and billing

• Viewing Security requires Security read access. Running an AI Deep Scan requires Security write access, which organization admins have by default.
• Advanced and Enterprise include continuous pull request security review.
• AI Deep Scan is usage-based and is not included with Advanced or Enterprise. Some organizations can have a separate free allowance; otherwise, usage billing must be enabled.

For detailed usage and billing behavior, see Usage and limits.

​

Run an AI Deep Scan

Start one AI Deep Scan for one repository at a time from the Security area in CodeRabbit. CodeRabbit does not start another AI Deep Scan while one is active for the same repository. Billing or monthly limit issues are shown before the scan starts; see Usage and limits. After starting the scan, open Security > Scan history to track its progress and view its current status.

​

Track scan status

Scan history shows each scan’s type, status, repository, duration, who triggered it and when, and scan ID. A scan can appear as Pending, Running, Completed, Partial, or Failed. Completed describes the execution status. A completed AI Deep Scan can still show partial coverage and follow-up work when repository traversal or coverage analysis reaches a file cap. Select a Completed or Partial scan to open its findings and scan details. The details include the result summary, runtime, repository, trigger information, and full scan ID, which you can copy for troubleshooting. When viewing an older scan, select View latest findings to return to the repository’s latest results. Partial means the scan completed, but its results cover only the analyzed scope. The findings page explains why coverage was limited.

​

Understand AI Deep Scan

​

What it finds

AI Deep Scan looks for practical vulnerabilities across supported source and infrastructure files, including:

• Authentication and access control — Authorization bypass, IDOR, broken authentication, and CSRF
• Unsafe input and data handling — Injection, XSS, SSRF, open redirects, insecure deserialization, and path traversal
• Sensitive data and configuration — Sensitive data exposure, information disclosure, CORS issues, weak cryptography, denial of service, and security misconfiguration
• AI and LLM applications — Prompt injection, improper output handling, excessive agency, and other LLM security risks
• Infrastructure as code — Misconfigurations in Terraform, OpenTofu, Kubernetes, Helm, Dockerfile, Containerfile, Bicep, CloudFormation, ARM templates, and Compose files

Infrastructure checks run automatically without additional setup. Repositories that contain only supported infrastructure files participate in the same analysis and verification workflow.

​

How it works

AI Deep Scan combines rule-based signals with AI reasoning across files, services, and infrastructure configuration:

• Map — Inventories the repository, groups related code into subsystems, and maps security-relevant entry points, trust boundaries, controls, sinks, and configuration.
• Investigate — Follows repository relationships from high-risk points to callers and supporting files, traces untrusted input to security-sensitive operations, and validates suspected infrastructure misconfigurations.
• Verify — Reopens the cited code and configuration, checks the supporting evidence, and rejects duplicate, mitigated, speculative, test-only, dead-code, unreachable, or otherwise unsupported candidates.

Repository relationships provide advisory leads. AI Deep Scan reopens and confirms the cited source before reporting a finding. If relationship evidence is unavailable or unusable, the scan continues with source-driven analysis. Rule-based results are candidate signals rather than final findings. They must be confirmed against repository evidence before they are reported. This repository-wide reasoning can identify authorization bypass, IDOR, and other business-logic flaws that rule matching alone may miss.

​

Coverage and evidence

Coverage follows the repository’s scan settings. Configured path exclusions are skipped, and a completed scan can report partial coverage when analysis limits prevent every eligible area from being investigated. If analysis cannot reach a supported conclusion, AI Deep Scan records the remaining work instead of treating incomplete analysis as evidence that the repository is secure. Each reported finding cites repository evidence and can include:

• Category, severity, and CWE
• Repository, file path, line range, and subsystem
• Description and recommendation
• Reachability, exploitability, and a reachability call stack when available
• Inline code context or a permalink to the scanned commit
• Finding status and Fix with AI status

CodeRabbit Security does not prove that a repository has no vulnerabilities. Results reflect only the repository content and scope that CodeRabbit analyzed.

​

Reachability and exploitability

Reachability describes whether a path exists from untrusted input to risky code. Exploitability describes the effort or access an attacker needs after reaching that code. These signals can adjust a finding’s severity: AI Deep Scan establishes External reachability only from a complete caller chain that starts at a named public API or framework entry point, ends at the sink, and is confirmed in source. Incomplete, ambiguous, historical, heuristic, or integrity-degraded relationship evidence remains a planning lead and cannot establish reachability. AI Deep Scan normally reports new findings only when verification establishes External or Internal reachability. Older findings can also show Unreachable or Unknown reachability; Unknown means CodeRabbit could not determine a path, not that the issue is exploitable.

​

Configure AI Deep Scan

From Security > Repositories, select a repository and open Settings > Scan configuration to configure its scan behavior. For guidance on choosing between context, Custom Path Instructions, finding Learnings, linked repositories, and exclusions, see Steer AI Deep Scans.

​

Branch and exclusions

For GitHub repositories, choose the branch CodeRabbit should scan. Provider default follows the repository default branch. If a custom branch is deleted, select another branch or return to the provider default before running the next scan. Use AI Deep Scan > Path Exclude Filters to skip files and directories during AI Deep Scan analysis.

​

Repository context

Repository context is optional architecture and business-domain background that helps AI Deep Scan interpret the repository. Enter up to 4,000 characters directly in AI Deep Scan > Context, including relevant facts from external documents or dashboards. The saved context applies to subsequent AI Deep Scans for that repository. See Repository context for what to include and an example. AI Deep Scan can use tools marked read-only from configured MCP Servers for additional evidence. Your MCP settings control which servers and tools AI Deep Scan can use. Use provider permissions to restrict what the connected account can change. Tool metadata alone does not enforce those permissions. Leaving the field empty removes the saved context. Context helps CodeRabbit interpret the codebase, but it cannot override scan instructions; security-relevant claims are still checked against repository evidence.

​

Linked repositories

AI Deep Scan can read linked repositories to investigate and verify findings in the repository you scan. For example, a scan of an API service can use a linked authentication library to check how a request is authorized. Linked repositories provide read-only context. Findings and coverage remain attached to the primary repository; run a separate scan to assess a linked repository itself.

​

Platform and plan support

You need AI Deep Scan access and a plan that supports Multi-Repo Analysis. Essentials supports manual links; Team, Advanced, and Enterprise also support automatic linking. A scan can read up to 20 linked repositories, subject to your plan’s linked repository limit. Eligible public open-source repositories can use manual public links under their OSS allowance; automatic linking is unavailable with OSS access. Enabling AI Deep Scan usage billing alone does not grant linked context to the Free plan. Viewing and selecting linked source requires Security write access and Repository settings read access. Changing the shared links or linking mode also requires Repository settings write access. You can manage the saved selection before enabling scan usage billing, but running a scan still requires an available free allowance or enabled usage billing.

​

Configure links and source access

Source selection depends on the linking mode:

• Manual: Only selected repositories are readable. Clear all selections to run without linked source.
• Automatic: Until you customize the source list, all eligible linked repositories are readable up to your plan limit, including new discoveries. Deselecting a repository saves a specific list. Selecting all eligible repositories again restores automatic inclusion of future discoveries. To read no linked repositories, switch to Manual and clear the selection.

Links from .coderabbit.yaml, inherited settings, and automatic discovery can appear as candidates. They follow configuration precedence; a configured link must still satisfy scan access and plan requirements.

​

Scan scope and evidence

CodeRabbit checks access again when a scan starts. It pins linked source to a commit on each linked repository’s default branch for that scan. PR review branch references do not select the linked revision for AI Deep Scan. When a finding cites linked source, its detail drawer shows Context evidence with the repository, file, commit, and a source link. Selecting a repository does not guarantee a citation. The cited commit also does not establish which version is deployed. If linked source cannot be prepared during analysis, the scan can continue with the available context. Missing linked source is a gap in evidence, not proof that the primary repository is safe.

​

When a link is unavailable

• No linked repositories available: Check the shared link configuration and plan limits. Automatic discovery can take time.
• Repository settings are disabled: Enable them in repository configuration before linked repositories apply.
• Could not verify linked repositories: Open Manage and reload the settings. On GitHub, use Check GitHub access to refresh provider access.
• A saved selection is no longer eligible: It is skipped. Restore provider access or use Remove unavailable in Security repository settings.
• Source access did not save: Use Retry and wait for Saved. before starting the scan. Adding a shared link alone does not select it for scanning in Manual mode.

​

Custom Path Instructions

Use AI Deep Scan > Custom Path Instructions to create, edit, and delete saved Custom Path Instructions for specific files or directories without excluding them from analysis. Each entry pairs a repository-relative path or glob, such as src/auth/**, with an instruction that applies only when AI Deep Scan analyzes matching files. You can save up to 100 path instructions per repository. Each instruction can contain up to 4,000 characters, and its path follows the same validation rules as an excluded path.

​

Recurring schedules

For GitHub repositories, you can set one recurring weekly AI Deep Scan schedule per repository. Choose one or more days, a time in 24-hour format, and an IANA timezone. Scheduled AI Deep Scans require an available free allowance or enabled usage billing. Because a scheduled run cannot ask you to approve an overage, it does not continue when its estimate exceeds the remaining monthly cap. See Usage and limits.

​

Triage and remediate findings

​

Filter, share, and export

• Attack surface — the default Security page after onboarding, showing mapped surface and verification coverage from PR reviews and AI Deep Scans.
• Findings — AI Deep Scan vulnerability and secret findings.
• Repositories — findings, coverage, and scan configuration for each repository.
• PR security reviews — security issues raised during pull request reviews; the same report is also available under Analytics.
• Scan history — a record of scan runs.

Each repository has Attack surface, Findings, Scan history, Learnings, and Settings tabs. Manual context and path instructions remain under Settings; Learnings lists saved accepted-risk guidance. The Findings page lets you filter AI Deep Scan findings by repository, severity, category, status, subsystem, and search text. Open a finding to inspect its evidence, recommendation, reachability, exploitability, code context, and available actions. From Share, choose For humans to copy a direct link or For agents to copy self-contained Markdown with the finding details and recommendation.

​

Dismiss finding and Learnings

Open Dismiss finding from a finding’s table-row actions or detail-drawer actions. It provides three options for AI Deep Scan findings:

• Ignore this finding — Marks the current finding as ignored without saving guidance.
• Create a learning — Saves suppression guidance for future scans with an Auto, Current file, or Entire repository scope. Auto infers the scope and defaults to the current file when unclear.
• Create a path instruction — Saves guidance for a repository-relative path or glob.

Creating a learning or path instruction does not dismiss the current finding. In later scans, CodeRabbit applies a learning only when the finding’s behavior and scope match. File-scoped Learnings apply only to the exact repository-relative file, repository-scoped Learnings apply across the repository, and path instructions apply to files that match their configured path or glob. The repository’s Learnings tab lists up to 100 of its newest Security Learnings with their guidance, file scope, and last-updated time. Repository-wide guidance displays All files. You can edit or delete saved entries; these Security Learnings are separate from the Learnings used in pull request reviews. For examples and help choosing between feedback types, see Learn from a finding. For a vulnerability whose severity needs correction, use Change severity and provide a reason. This saves a Learning for future severity calibration without suppressing the finding. Severity Learnings are file-scoped by default; repository-scoped guidance applies across files only when the reason explicitly supports that scope. See Calibrate severity.

​

Resolve finding

Resolve finding is separate from Dismiss finding and applies to eligible AI Deep Scan vulnerabilities. Enter non-blank supporting context of up to 10,000 characters, such as a pull request URL or an explanation of the fix. After a successful resolution, CodeRabbit marks the finding as resolved, records when and how it was resolved, and removes it from the active findings view. A finding that is already resolved cannot be resolved again.

​

Fix with AI

Fix with AI creates a pull request or merge request for supported AI Deep Scan findings; CodeRabbit does not merge it automatically. A new fix cannot start while another fix for the same finding is pending or running. You can retry a failed fix and open the generated pull request or merge request when it is ready. Each fix runs as a task. Open the task to follow its activity, steer the work, and review the proposed patch before delivery. See Work with a coding task.

​

Usage and limits

​

Plan coverage

Advanced and Enterprise include continuous pull request security review. AI Deep Scan uses separate usage-based billing.

​

AI Deep Scan estimates and billing

AI Deep Scan is usage-based and is not included with Advanced or Enterprise. Some organizations can have a separate free allowance. After that allowance is used, or when no allowance is available, someone with Subscription write access must enable AI Deep Scan usage billing. Before a scan starts, CodeRabbit estimates the required credits from the scannable files on the effective branch after applying saved AI Deep Scan path exclusions. If the estimate exceeds the organization’s remaining monthly cap, a manually started scan can be canceled or confirmed as overage. Users with Subscription write access can also update the cap. Scheduled scans cannot request overage confirmation and do not continue above the cap; estimates from pending and running scans count toward the remaining cap. When usage billing applies, the final charge is based on actual scan usage and is recorded after the scan finishes with a Completed or Partial status. Credit estimates are not final invoices.

​

What’s next