Security Blast Radius maps changed components and the paths between them while keeping matched Security Architecture findings close at hand
You must have access to the pull request and its CodeRabbit Security review coverage. Advanced and Enterprise include this coverage; active legacy Security trials and add-ons remain supported for compatibility.
What the graph shows
The summary above the graph counts changed, upstream, downstream, and potentially impacted components. CodeRabbit may combine closely related components into collapsed stacks to keep a large graph readable.
Open Security Blast Radius
1
Open Change Stack
Open the pull request’s Review Change Stack → link from the CodeRabbit walkthrough.
2
Select Security Blast Radius
In the left rail, select Security Blast Radius. If the graph is still being prepared, Change Stack shows its generation status.
3
Start from the changed components
Use the changed components at the center of the map as the starting point, then follow their upstream, downstream, test, and supporting relationships.
Open Change Stack, then select Security Blast Radius from the rail
Explore the impact map
Expand grouped components
Related components can appear as a collapsed stack. Select a collapsed stack to expand it, or use Expand all to reveal every available component. Collapse stacks again when you want to return to the higher-level paths.
The expanded graph reveals two potentially impacted consumers outside the pull request diff, together with upstream dependencies and related context
Components labeled Potentially impacted can be outside the pull request diff. CodeRabbit found repository evidence that connects them to the changed behavior, so they are useful places to inspect next. The label does not confirm a defect or guarantee runtime impact.
Inspect a component
Select a component to open its details. The panel explains why the component matters to the pull request and groups its evidence into changed snippets, impacted dependents, and other supporting ranges when applicable. Each range includes its repository path, line location, summary, and available evidence labels. Select a range to inspect the source without leaving the graph.Inspect a relationship
Select a connection between two components to see the relationship type, confidence, summary, and supporting ranges. Relationship evidence separates the changed snippets that caused the connection from the impacted or supporting code on the other side.A relationship means CodeRabbit found evidence connecting the two components for this review. It does not, by itself, mean the pull request contains a defect or vulnerability.
Return to the diff
When evidence comes from a changed range, use Open in layer to return to the Change Stack layer containing that code. This lets you move from the impact map to the exact diff and its range summary.Review Security Architecture findings
When Security Architecture Review findings match components in the graph, the toolbar shows a Security control and the number of matched findings.- Select Security to highlight all components and paths associated with Security Architecture findings.
- Select an individual finding in the legend to focus on the components associated with that finding.
- Select a highlighted component to inspect the code ranges supporting the match.
Selecting the high-severity F1 finding highlights its affected component path while de-emphasizing unrelated graph context
Understand limited results
Security Blast Radius reports the evidence available for the reviewed snapshot instead of filling gaps with inferred relationships.Keep the graph current
Security Blast Radius is tied to the commit analyzed by the latest CodeRabbit review. When new commits make an analysis stale, Change Stack provides a separate refresh action for Security Blast Radius and Architecture Impact. Use the action for the selected analysis to regenerate only that analysis against the latest pull request commit. Availability is independent for each analysis. Security Blast Radius can refresh without Architecture Impact enabled, and Architecture Impact can refresh even when the Security Blast Radius rollout is disabled because Change Stack prepares the required security graph internally. You can continue using the current graph for the selected analysis while an update is prepared, but its evidence reflects the earlier reviewed snapshot until the new analysis finishes.How CodeRabbit builds the graph
CodeRabbit starts with the exact ranges represented in Change Stack, then adds selected repository context and code relationships discovered during the review. It builds the component and relationship structure from that evidence before generating reviewer-facing names and summaries. The generated explanation can group related evidence and clarify what a relationship means, but it cannot add unsupported components, connections, or relationship directions. If the explanation cannot be generated or validated, Change Stack can fall back to the evidence-backed structure.Related Change Stack views
What’s next
Security Architecture Review
Understand the architecture-level security assessment that supplies findings to the graph.
Change Stack
Review the complete Change Stack workflow, including cohorts, layers, comments, and coding tasks.
CodeRabbit Security
Run Deep Scan against committed repository code to find exploitable vulnerabilities and exposed secrets.