Attack surface and continuous posture

| The Attack surface map is a living view of the security-relevant parts of a repository. It organizes mapped code locations by subsystem, shows which locations have current verification evidence, overlays open findings, and tracks where merged changes have made earlier verification stale. Open Security > Repositories, select a repository, and choose the Attack surface tab.

​

What the map contains

CodeRabbit identifies security-relevant points in the repository and groups them into subsystems. Each point belongs to one of five lanes: The map also records relationships between points. Select a tile to open a focused flow showing the selected point, its recorded connections, code location, verification state, and nearby security context.

​

How the map is created

The source of the map determines what its coverage percentage means.

​

How continuous posture management works

After CodeRabbit creates a map, it keeps the posture aligned with changes to the repository’s default branch:

1. When a merged pull request changes a mapped area, CodeRabbit treats the affected verification as stale until it has current evidence for the landed code.
2. If a CodeRabbit-reviewed pull request provides matching security evidence for the exact merged change, CodeRabbit can refresh the affected points and add newly discovered security-relevant points.
3. Changes without sufficient matching review evidence can reduce verified coverage, but they do not create proof that the changed code is safe.
4. A later complete AI Deep Scan inventories the current repository, verifies the mapped surface at the scan commit, discovers additional points, and establishes a fresh repository-wide baseline.

This process preserves the distinction between what CodeRabbit knows exists, what has current verification evidence, and which findings are open. A mapped point can be current without having a finding, and an open finding does not by itself prove that every related point is verified.

​

Read verification coverage

The summary at the top of the map reports:

• Verified — the percentage and count of mapped points with current verification evidence. For a pull-request-derived map, the label is Verified in known surface.
• Stale — the percentage of mapped points whose earlier verification no longer matches the current code.
• Mapped points — the size of the currently known security-relevant surface.

Coverage and stale metrics include recent trend indicators as posture changes over time. Each map tile uses a status that keeps verification and finding severity visible: Hover over a tile to see its symbol, file and line, lane, subsystem, verification state, and finding severity. Select the tile to explore its recorded relationships. The focused relationship view prioritizes nearby relevant points and indicates when additional connected points are not shown.

​

Improve or refresh coverage

Run an AI Deep Scan when you need to:

• establish repository-wide coverage for a map built only from reviewed pull requests;
• investigate incomplete or stale mapped areas;
• discover security-relevant points that have not appeared in reviewed changes; or
• refresh the verified baseline after substantial repository changes.

AI Deep Scan is usage-based. Review the estimate and billing controls before starting a scan; see CodeRabbit Security usage and limits.

​

What’s next