> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Attack surface and continuous posture

> Understand how CodeRabbit maps security-relevant code, tracks verification coverage, and keeps repository posture current as pull requests merge.

export const AdvancedPlanBadge = ({tip = "This feature is available on Advanced and Enterprise. Please refer to our pricing page for more information about our plans and features.", title = "Advanced Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="shield-plus" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const OpenBetaBadge = ({tip = "This feature is currently in open beta. We are actively improving it based on your feedback. If you encounter any issues or have suggestions, please share them on our Discord community or visit the support page.", title = "Open Beta", cta = "Contact support", href = "/support", disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="badge-alert" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const GitLabBadge = ({tip = "This feature is available on GitLab.", title = "GitLab", cta, href, disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="gitlab" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const GitHubBadge = ({tip = "This feature is available on GitHub and GitHub Enterprise.", title = "GitHub", cta, href, disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="github" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const BitbucketBadge = ({tip = "This feature is available on Bitbucket.", title = "Bitbucket", cta, href, disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="bitbucket" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const AzureBadge = ({tip = "This feature is available on Azure DevOps.", title = "Azure", cta, href, disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="microsoft" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

<GitHubBadge /> <GitLabBadge tip="CodeRabbit Security is available on GitLab and self-hosted GitLab." /> <AzureBadge tip="CodeRabbit Security is available on Azure DevOps Services. Azure DevOps Server is not supported." /> <BitbucketBadge tip="CodeRabbit Security is available on Bitbucket Cloud." /> | <AdvancedPlanBadge /> <OpenBetaBadge tip="CodeRabbit Security is currently available in beta." />

The **Attack surface** map is a living view of the security-relevant parts of a repository. It organizes mapped code locations by subsystem, shows which locations have current verification evidence, overlays open findings, and tracks where merged changes have made earlier verification stale.

Open **Security > Repositories**, select a repository, and choose the **Attack surface** tab.

<Info>
  The Attack surface map shows verification coverage and drift. Use **Agent Findings** or **PR Findings** to investigate and manage individual security findings.
</Info>

## What the map contains

CodeRabbit identifies security-relevant points in the repository and groups them into subsystems. Each point belongs to one of five lanes:

| Lane             | What it represents                                                              | Examples                                                                               |
| ---------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Entry points     | Where external or user-controlled input enters the system                       | HTTP routes, webhooks, command-line input, background jobs, and message consumers      |
| Trust boundaries | Where data crosses between trust levels and requires validation or sanitization | User-to-service and service-to-third-party transitions                                 |
| Access controls  | Where the application decides who can perform an action or access data          | Authentication, authorization, tenant scoping, and validation checks                   |
| Sinks            | Security-sensitive operations that attacker-controlled data might reach         | Database queries, shell commands, file writes, templates, and outbound network calls   |
| Security config  | Configuration that affects the repository's security posture                    | Secrets handling, TLS, CORS or CSP, permissions, IAM, and build or deployment settings |

The map also records relationships between points. Select a tile to open a focused flow showing the selected point, its recorded connections, code location, verification state, and nearby security context.

## How the map is created

The source of the map determines what its coverage percentage means.

| Map source             | Scope                             | What coverage means                                                                                                                                           |
| ---------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Reviewed pull requests | Known reviewed surface            | The map contains security-relevant points discovered in CodeRabbit-reviewed pull requests. Code outside this known surface is not included in the percentage. |
| Repository mapping     | Repository-wide inventory         | CodeRabbit inventories and maps the repository. Areas that have not been fully investigated can remain incomplete.                                            |
| Complete AI Deep Scan  | Repository-wide verified baseline | CodeRabbit inventories the repository and deeply investigates mapped security points at the scanned commit.                                                   |

<Warning>
  100% coverage of a **known reviewed surface** does not mean the entire repository has been mapped or verified. Run an AI Deep Scan to establish or refresh a repository-wide baseline. A partial scan preserves the existing map and adds the evidence it completed; it does not replace the baseline.
</Warning>

## How continuous posture management works

After CodeRabbit creates a map, it keeps the posture aligned with changes to the repository's default branch:

1. When a merged pull request changes a mapped area, CodeRabbit treats the affected verification as stale until it has current evidence for the landed code.
2. If a CodeRabbit-reviewed pull request provides matching security evidence for the exact merged change, CodeRabbit can refresh the affected points and add newly discovered security-relevant points.
3. Changes without sufficient matching review evidence can reduce verified coverage, but they do not create proof that the changed code is safe.
4. A later complete AI Deep Scan inventories the current repository, verifies the mapped surface at the scan commit, discovers additional points, and establishes a fresh repository-wide baseline.

This process preserves the distinction between **what CodeRabbit knows exists**, **what has current verification evidence**, and **which findings are open**. A mapped point can be current without having a finding, and an open finding does not by itself prove that every related point is verified.

## Read verification coverage

The summary at the top of the map reports:

* **Verified** — the percentage and count of mapped points with current verification evidence. For a pull-request-derived map, the label is **Verified in known surface**.
* **Stale** — the percentage of mapped points whose earlier verification no longer matches the current code.
* **Mapped points** — the size of the currently known security-relevant surface.

Coverage and stale metrics include recent trend indicators as posture changes over time.

Each map tile uses a status that keeps verification and finding severity visible:

| Status                | Meaning                                                                       |
| --------------------- | ----------------------------------------------------------------------------- |
| Fully verified        | The point has current verification evidence.                                  |
| Incomplete            | The point is mapped but does not have complete current verification evidence. |
| Stale                 | The point changed after its last verification and needs current evidence.     |
| Medium finding        | The point is associated with an open medium-severity finding.                 |
| High/critical finding | The point is associated with an open high- or critical-severity finding.      |

Hover over a tile to see its symbol, file and line, lane, subsystem, verification state, and finding severity. Select the tile to explore its recorded relationships. The focused relationship view prioritizes nearby relevant points and indicates when additional connected points are not shown.

## Improve or refresh coverage

Run an **AI Deep Scan** when you need to:

* establish repository-wide coverage for a map built only from reviewed pull requests;
* investigate incomplete or stale mapped areas;
* discover security-relevant points that have not appeared in reviewed changes; or
* refresh the verified baseline after substantial repository changes.

AI Deep Scan is usage-based. Review the estimate and billing controls before starting a scan; see [CodeRabbit Security usage and limits](/security#usage-and-limits).

## What's next

<CardGroup cols={1}>
  <Card title="CodeRabbit Security" href="/security" icon="shield-check" horizontal>
    Learn how AI Deep Scan, Agent Findings, PR Findings, and repository security settings work together.
  </Card>

  <Card title="Security Architecture Review" href="/security/architecture-review" icon="shield-check" horizontal>
    Assess architecture-level security implications introduced by a pull request.
  </Card>

  <Card title="Security Blast Radius" href="/security/blast-radius" icon="waypoints" horizontal>
    Explore how pull request changes connect to downstream components and security-relevant paths.
  </Card>
</CardGroup>