> ## Documentation Index > Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt > Use this file to discover all available pages before exploring further. # Security Blast Radius > Map how a pull request's changes connect to dependencies, downstream consumers, tests, and security-relevant paths in Change Stack. export const OpenBetaBadge = ({tip = "This feature is currently in open beta. We are actively improving it based on your feedback. If you encounter any issues or have suggestions, please share them on our Discord community or visit the support page.", title = "Open Beta", cta = "Contact support", href = "/support", disabled = false}) => { return {title} ; }; export const GitLabBadge = ({tip = "This feature is available on GitLab.", title = "GitLab", cta, href, disabled = false}) => { return {title} ; }; export const GitHubBadge = ({tip = "This feature is available on GitHub and GitHub Enterprise.", title = "GitHub", cta, href, disabled = false}) => { return {title} ; }; export const BitbucketBadge = ({tip = "This feature is available on Bitbucket.", title = "Bitbucket", cta, href, disabled = false}) => { return {title} ; }; export const AzureBadge = ({tip = "This feature is available on Azure DevOps.", title = "Azure", cta, href, disabled = false}) => { return {title} ; }; | Security Blast Radius helps you investigate what a pull request could affect beyond its changed lines. The graph places changed components alongside the dependencies they use, downstream consumers that may be affected, related tests, and supporting repository context. Every component and relationship links back to the code evidence CodeRabbit used to build the map. Security Blast Radius is included with the [Security Agent](/security-agent) and is available through [Change Stack](/pr-reviews/change-stack). It complements the layer-by-layer diff without changing the pull request or posting a separate graph to the Git provider. Security Blast Radius in dark mode with the Security findings panel open and three changed component stacks connected in the graph You must have access to the pull request and have an active Security Agent subscription or trial to load its graph and supporting code. ## What the graph shows | Graph element | What it means | | ------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Changed component | A component, service, API, worker, configuration surface, or other code concept modified by the pull request | | Upstream dependency | Code or infrastructure that a changed component uses | | Downstream consumer | Code that depends on changed behavior and may be affected by it | | Test coverage | Related tests that exercise changed behavior or its surrounding path | | Supporting context | Repository evidence that helps explain the change without establishing a direct downstream impact | | Relationship | An evidence-backed connection such as a call, import, dependency, read, write, publish, subscription, or test relationship | The summary above the graph counts changed, upstream, downstream, and potentially impacted components. CodeRabbit may combine closely related components into collapsed stacks to keep a large graph readable. ## Open Security Blast Radius Open the pull request's **Review Change Stack →** link from the CodeRabbit walkthrough. In the left rail, select **Security Blast Radius**. If the graph is still being prepared, Change Stack shows its generation status. Use the changed components at the center of the map as the starting point, then follow their upstream, downstream, test, and supporting relationships. Review Change Stack button leading to the selected Security Blast Radius entry in the Change Stack rail ## Explore the impact map ### Expand grouped components Related components can appear as a collapsed stack. Select a collapsed stack to expand it, or use **Expand all** to reveal every available component. Collapse stacks again when you want to return to the higher-level paths. Expanded Security Blast Radius graph showing upstream dependencies, test coverage, supporting context, and two potentially impacted downstream consumers around the changed components Components labeled **Potentially impacted** can be outside the pull request diff. CodeRabbit found repository evidence that connects them to the changed behavior, so they are useful places to inspect next. The label does not confirm a defect or guarantee runtime impact. ### Inspect a component Select a component to open its details. The panel explains why the component matters to the pull request and groups its evidence into changed snippets, impacted dependents, and other supporting ranges when applicable. Each range includes its repository path, line location, summary, and available evidence labels. Select a range to inspect the source without leaving the graph. ### Inspect a relationship Select a connection between two components to see the relationship type, confidence, summary, and supporting ranges. Relationship evidence separates the changed snippets that caused the connection from the impacted or supporting code on the other side. A relationship means CodeRabbit found evidence connecting the two components for this review. It does not, by itself, mean the pull request contains a defect or vulnerability. ### Return to the diff When evidence comes from a changed range, use **Open in layer** to return to the Change Stack layer containing that code. This lets you move from the impact map to the exact diff and its range summary. ## Review Security Architecture findings When [Security Architecture Review](/security-agent/architecture-review) findings match components in the graph, the toolbar shows a **Security** control and the number of matched findings. * Select **Security** to highlight all components and paths associated with Security Architecture findings. * Select an individual finding in the legend to focus on the components associated with that finding. * Select a highlighted component to inspect the code ranges supporting the match. Security Blast Radius with the high-severity F1 finding selected and its affected path highlighted across four components Security highlighting maps existing findings onto the graph. Security Blast Radius does not create a vulnerability finding solely because two components are connected. ## Understand limited results Security Blast Radius reports the evidence available for the reviewed snapshot instead of filling gaps with inferred relationships. | State | Meaning | | ----------------------------------- | -------------------------------------------------------------------------------------------------------------- | | **Changed code structure** | CodeRabbit found the changed structure but no supported impact path outside the pull request | | **No material blast radius** | The available evidence did not establish a larger material impact path beyond the changed ranges | | **Showing N of M graph candidates** | CodeRabbit capped lower-ranked code-graph candidates to keep the graph readable | | **Generating** | The graph is still being prepared for this review | | **Not available** | The repository, review, authentication state, or required review evidence does not currently support the graph | An absent component or relationship means it was not established by the evidence available to this review. It does not prove that no dependency or downstream impact exists. ## Keep the graph current Security Blast Radius is tied to the commit analyzed by a CodeRabbit review. When new commits make the graph stale, Change Stack can show **Update graphs**. Use it to regenerate both Security Blast Radius and Architecture impact against the latest pull request commit. You can continue using the existing graph while an update is prepared, but its evidence reflects the earlier reviewed snapshot until the new analysis finishes. ## How CodeRabbit builds the graph CodeRabbit starts with the exact ranges represented in Change Stack, then adds selected repository context and code relationships discovered during the review. It builds the component and relationship structure from that evidence before generating reviewer-facing names and summaries. The generated explanation can group related evidence and clarify what a relationship means, but it cannot add unsupported components, connections, or relationship directions. If the explanation cannot be generated or validated, Change Stack can fall back to the evidence-backed structure. ## Related Change Stack views | View | Question it helps answer | | --------------------- | ---------------------------------------------------------------------------------- | | Layers | In what order should I read the changed code? | | Security Blast Radius | What does this change connect to or potentially affect? | | Architecture impact | What higher-level system responsibilities and architectural relationships changed? | ## What's next Understand the architecture-level security assessment that supplies findings to the graph. Review the complete Change Stack workflow, including cohorts, layers, comments, and coding tasks. Scan committed repository code for vulnerabilities, exposed secrets, and vulnerable dependencies.