Skip to main content
| Security Blast Radius helps you investigate what a pull request could affect beyond its changed lines. The graph places changed components alongside the dependencies they use, downstream consumers that may be affected, related tests, and supporting repository context. Every component and relationship links back to the code evidence CodeRabbit used to build the map. Security Blast Radius is included with the Security Agent and is available through Change Stack. It complements the layer-by-layer diff without changing the pull request or posting a separate graph to the Git provider.
Security Blast Radius in dark mode with the Security findings panel open and three changed component stacks connected in the graph

Security Blast Radius maps changed components and the paths between them while keeping matched Security Architecture findings close at hand

You must have access to the pull request and have an active Security Agent subscription or trial to load its graph and supporting code.

​
What the graph shows

The summary above the graph counts changed, upstream, downstream, and potentially impacted components. CodeRabbit may combine closely related components into collapsed stacks to keep a large graph readable.

​
Open Security Blast Radius

1

Open Change Stack

Open the pull request’s Review Change Stack → link from the CodeRabbit walkthrough.
2

Select Security Blast Radius

In the left rail, select Security Blast Radius. If the graph is still being prepared, Change Stack shows its generation status.
3

Start from the changed components

Use the changed components at the center of the map as the starting point, then follow their upstream, downstream, test, and supporting relationships.
Review Change Stack button leading to the selected Security Blast Radius entry in the Change Stack rail

Open Change Stack, then select Security Blast Radius from the rail

​
Explore the impact map

​
Expand grouped components

Related components can appear as a collapsed stack. Select a collapsed stack to expand it, or use Expand all to reveal every available component. Collapse stacks again when you want to return to the higher-level paths.
Expanded Security Blast Radius graph showing upstream dependencies, test coverage, supporting context, and two potentially impacted downstream consumers around the changed components

The expanded graph reveals two potentially impacted consumers outside the pull request diff, together with upstream dependencies and related context

Components labeled Potentially impacted can be outside the pull request diff. CodeRabbit found repository evidence that connects them to the changed behavior, so they are useful places to inspect next. The label does not confirm a defect or guarantee runtime impact.

​
Inspect a component

Select a component to open its details. The panel explains why the component matters to the pull request and groups its evidence into changed snippets, impacted dependents, and other supporting ranges when applicable. Each range includes its repository path, line location, summary, and available evidence labels. Select a range to inspect the source without leaving the graph.

​
Inspect a relationship

Select a connection between two components to see the relationship type, confidence, summary, and supporting ranges. Relationship evidence separates the changed snippets that caused the connection from the impacted or supporting code on the other side.
A relationship means CodeRabbit found evidence connecting the two components for this review. It does not, by itself, mean the pull request contains a defect or vulnerability.

​
Return to the diff

When evidence comes from a changed range, use Open in layer to return to the Change Stack layer containing that code. This lets you move from the impact map to the exact diff and its range summary.

​
Review Security Architecture findings

When Security Architecture Review findings match components in the graph, the toolbar shows a Security control and the number of matched findings.
  • Select Security to highlight all components and paths associated with Security Architecture findings.
  • Select an individual finding in the legend to focus on the components associated with that finding.
  • Select a highlighted component to inspect the code ranges supporting the match.
Security Blast Radius with the high-severity F1 finding selected and its affected path highlighted across four components

Selecting the high-severity F1 finding highlights its affected component path while de-emphasizing unrelated graph context

Security highlighting maps existing findings onto the graph. Security Blast Radius does not create a vulnerability finding solely because two components are connected.

​
Understand limited results

Security Blast Radius reports the evidence available for the reviewed snapshot instead of filling gaps with inferred relationships.
An absent component or relationship means it was not established by the evidence available to this review. It does not prove that no dependency or downstream impact exists.

​
Keep the graph current

Security Blast Radius is tied to the commit analyzed by a CodeRabbit review. When new commits make the graph stale, Change Stack can show Update graphs. Use it to regenerate both Security Blast Radius and Architecture impact against the latest pull request commit. You can continue using the existing graph while an update is prepared, but its evidence reflects the earlier reviewed snapshot until the new analysis finishes.

​
How CodeRabbit builds the graph

CodeRabbit starts with the exact ranges represented in Change Stack, then adds selected repository context and code relationships discovered during the review. It builds the component and relationship structure from that evidence before generating reviewer-facing names and summaries. The generated explanation can group related evidence and clarify what a relationship means, but it cannot add unsupported components, connections, or relationship directions. If the explanation cannot be generated or validated, Change Stack can fall back to the evidence-backed structure.

​
What’s next

Security Architecture Review

Understand the architecture-level security assessment that supplies findings to the graph.

Change Stack

Review the complete Change Stack workflow, including cohorts, layers, comments, and coding tasks.

Security Agent

Scan committed repository code for vulnerabilities, exposed secrets, and vulnerable dependencies.