> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# CodeRabbit Security
> Scan GitHub, GitLab, Azure DevOps Services, and Bitbucket Cloud repositories for potential security issues across the committed codebase.
export const AdvancedPlanBadge = ({tip = "This feature is available on Advanced and Enterprise. Please refer to our pricing page for more information about our plans and features.", title = "Advanced Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const OpenBetaBadge = ({tip = "This feature is currently in open beta. We are actively improving it based on your feedback. If you encounter any issues or have suggestions, please share them on our Discord community or visit the support page.", title = "Open Beta", cta = "Contact support", href = "/support", disabled = false}) => {
return
{title}
;
};
export const GitLabBadge = ({tip = "This feature is available on GitLab.", title = "GitLab", cta, href, disabled = false}) => {
return
{title}
;
};
export const GitHubBadge = ({tip = "This feature is available on GitHub and GitHub Enterprise.", title = "GitHub", cta, href, disabled = false}) => {
return
{title}
;
};
export const BitbucketBadge = ({tip = "This feature is available on Bitbucket.", title = "Bitbucket", cta, href, disabled = false}) => {
return
{title}
;
};
export const AzureBadge = ({tip = "This feature is available on Azure DevOps.", title = "Azure", cta, href, disabled = false}) => {
return
{title}
;
};
|
Continuous pull request security review is included with Advanced and Enterprise. Existing Security trials and separately purchased Security add-ons remain supported for compatibility. AI Deep Scan is usage-based and billed separately from the review plan.
CodeRabbit Security brings repository-level security analysis to CodeRabbit. Advanced and Enterprise include continuous pull request security review and its supported outputs, including [Security Architecture Review](/security/architecture-review) and [Security Blast Radius](/security/blast-radius). **AI Deep Scan** is a separately metered scan that analyzes committed source code and infrastructure configuration for exploitable vulnerabilities beyond the current pull request diff. Repository security settings, recurring scans, continuous posture, and Dependency, SBOM, and Secrets scans use separate eligibility described below.
AI Deep Scan results appear under **Security > Agent Findings**, where you can inspect evidence, triage findings, export results, and start supported fixes. These findings are separate from **Pull Requests > PR Findings**, which come from security issues raised during pull request reviews.
CodeRabbit Security findings are separate from **Pull Requests > PR Findings**. PR Findings come from security issues raised during pull request review comments, while Agent Findings come from an AI Deep Scan.
## Security capabilities at a glance
| Capability | Purpose | Results |
| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| AI Deep Scan | Find exploitable vulnerabilities across committed source code and infrastructure configuration | **Security > Agent Findings** |
| Attack Surface | Map entry points, trust boundaries, sinks, access controls, and security configuration | **Security > Repositories > Attack Surface** |
| Dependencies | Find known vulnerabilities in supported manifests and lockfiles | **Security > Repositories > Dependencies** |
| SBOM | Build a resolved component inventory with license information | **Security > Repositories > SBOM** |
| Secrets | Find leaked secrets and hardcoded credentials, with optional verification and Git history scanning | **Security > Repositories > Secrets** |
| [PR Findings](#pr-findings) | Show security issues raised during pull request reviews | **Security > Pull Requests > PR Findings** |
| [Security Architecture Review](/security/architecture-review) | Assess security implications that span changed components, trust boundaries, controls, and downstream dependencies | **Change Stack > Overview** |
| Architecture Impact | Overlay mapped Security Architecture findings on the changed-architecture view | [**Change Stack > Architecture Impact**](/pr-reviews/change-stack#architecture-impact) |
| [Security Blast Radius](/security/blast-radius) | Map how pull request changes connect to dependencies, downstream consumers, tests, and security-relevant paths | **Change Stack > Security Blast Radius** |
CodeRabbit Security offers two code-scan tiers. An AI Initial Scan is the lighter entry-point scan that builds the repository security posture map without running an AI Deep Scan.
## PR Findings
Open **Security > Pull Requests > PR Findings** to review security issues raised during pull request reviews. Each finding shows its status and severity, plus separate **Reachability** and **Exploitability** badge columns.
### PR Findings filters
Use the **PR status** filter to show **All**, **Open**, **Merged**, or **Closed** pull requests. **Author** is a searchable multi-select filter for choosing one or more pull request authors. Its menu continues to list all authors while filters are active, so you can switch authors without first clearing the current selection.
Filters apply to the full organization-wide PR Findings result set before pagination, and the reported total reflects the filtered set. Changing either filter returns the list to page one and closes any open pull request detail.
The PR status filter describes the lifecycle of a pull request. It is separate from the status of each individual security finding.
If an active filter returns no results, PR Findings shows **No pull requests match these filters**. This is distinct from the existing empty state shown when the organization has no PR Findings.
### Reachability tiers
| Tier | Meaning |
| ------------- | ---------------------------------------------------------- |
| `external` | The finding is reachable from an external entry point |
| `internal` | The finding is reachable only from an internal entry point |
| `unreachable` | No reachable path to the finding was identified |
### Exploitability tiers
| Tier | Meaning |
| ------------- | ----------------------------------------------------------- |
| `trivial` | Exploitation requires minimal effort |
| `moderate` | Exploitation requires some effort or prerequisites |
| `difficult` | Exploitation requires substantial effort or prerequisites |
| `theoretical` | Exploitation is theoretical based on the available evidence |
A dash means no valid tier was available from the live provider review comment. This can happen for older findings or provider responses without the enriched comment body.
## Before you start
### Supported providers
* GitHub Cloud and GitHub Enterprise Server
* GitLab Cloud and self-hosted GitLab
* Azure DevOps Services
* Bitbucket Cloud
### Unsupported providers
* Bitbucket Data Center
* Azure DevOps Server (ADO Server)
Repository security settings, code context links, and Fix with AI are available on all supported providers. Custom scan branches and recurring schedules are currently available only for GitHub repositories.
### Access and billing
* Viewing Security requires Security read access. Running an AI Deep Scan requires Security write access, which organization admins have by default.
* Advanced and Enterprise include continuous pull request security review. Existing active Security trials and legacy Security add-ons remain supported for compatibility.
* Repository Security settings, recurring schedules, continuous posture updates, and Dependency, SBOM, and Secrets scans require separate premium Security eligibility, such as an active legacy Security trial or add-on. Eligible open-source organizations can also receive this access.
* AI Deep Scan is usage-based and is not included with Advanced, Enterprise, a legacy Security trial, or a legacy Security add-on. Some organizations can have a separate free allowance; otherwise, usage billing must be enabled.
For detailed trial, seat, billing, and fair-use behavior, see [Usage and limits](#usage-and-limits).
## Run an AI Deep Scan
Start one AI Deep Scan for one repository at a time from the Security area in CodeRabbit.
In the CodeRabbit app, go to [Security](https://app.coderabbit.ai/security/overview).
Click **Scan repository**.
Select the supported repository you want to scan. You can scan one repository at a time. Provider-archived repositories do not appear in the repository selection after CodeRabbit records their archive state.
Under **Scan type**, select **AI Deep Scan**.
If scan credits apply, review the estimated credits for the repository. The estimate uses the effective scan branch and saved AI Deep Scan path exclusions.
Click **Scan now**.
CodeRabbit does not start another AI Deep Scan while one is active for the same repository. Billing or monthly limit issues are shown before the scan starts; see [Usage and limits](#usage-and-limits).
After starting the scan, open [**Security > Activity Log**](https://app.coderabbit.ai/security/activity) to track its progress and view its current status.
## Track scan status
The **Activity Log** shows each scan's type, status, repository, duration, who triggered it and when, and scan ID. A scan can appear as **Pending**, **Running**, **Completed**, **Partial**, or **Failed**.
**Completed** describes the execution status. A completed AI Deep Scan can still show partial coverage and follow-up work when repository traversal or coverage analysis reaches a file cap.
Select a **Completed** or **Partial** scan to open its findings and scan details. The details include the result summary, runtime, repository, trigger information, and full scan ID, which you can copy for troubleshooting. When viewing an older scan, select **View latest findings** to return to the repository's latest results.
**Partial** means the scan completed, but its results cover only the analyzed scope. The findings page explains why coverage was limited.
## Understand AI Deep Scan
### What it finds
AI Deep Scan looks for practical vulnerabilities across supported source and infrastructure files, including:
* **Authentication and access control** — Authorization bypass, IDOR, broken authentication, and CSRF
* **Unsafe input and data handling** — Injection, XSS, SSRF, open redirects, insecure deserialization, and path traversal
* **Sensitive data and configuration** — Sensitive data exposure, information disclosure, CORS issues, weak cryptography, denial of service, and security misconfiguration
* **AI and LLM applications** — Prompt injection, improper output handling, excessive agency, and other LLM security risks
* **Infrastructure as code** — Misconfigurations in Terraform, OpenTofu, Kubernetes, Helm, Dockerfile, Containerfile, Bicep, CloudFormation, ARM templates, and Compose files
Infrastructure checks run automatically without additional setup. Repositories that contain only supported infrastructure files participate in the same analysis and verification workflow.
### How it works
AI Deep Scan combines rule-based signals with AI reasoning across files, services, and infrastructure configuration:
* **Map** — Inventories the repository, groups related code into subsystems, and maps security-relevant entry points, trust boundaries, controls, sinks, and configuration.
* **Investigate** — Follows repository relationships from high-risk points to callers and supporting files, traces untrusted input to security-sensitive operations, and validates suspected infrastructure misconfigurations.
* **Verify** — Reopens the cited code and configuration, checks the supporting evidence, and rejects duplicate, mitigated, speculative, test-only, dead-code, unreachable, or otherwise unsupported candidates.
Repository relationships provide advisory leads. AI Deep Scan reopens and confirms the cited source before reporting a finding. If relationship evidence is unavailable or unusable, the scan continues with source-driven analysis.
Rule-based results are candidate signals rather than final findings. They must be confirmed against repository evidence before they are reported. This repository-wide reasoning can identify authorization bypass, IDOR, and other business-logic flaws that rule matching alone may miss.
### Coverage and evidence
Coverage follows the repository's scan settings. Configured path exclusions are skipped, and a completed scan can report partial coverage when analysis limits prevent every eligible area from being investigated. If analysis cannot reach a supported conclusion, AI Deep Scan records the remaining work instead of treating incomplete analysis as evidence that the repository is secure.
Each reported finding cites repository evidence and can include:
* Category, severity, and CWE
* Repository, file path, line range, and subsystem
* Description and recommendation
* Reachability, exploitability, and a reachability call stack when available
* Inline code context or a permalink to the scanned commit
* Finding status and Fix with AI status
CodeRabbit Security does not prove that a repository has no vulnerabilities. Results reflect only the repository content and scope that CodeRabbit analyzed.
### Reachability and exploitability
Reachability describes whether a path exists from untrusted input to risky code. Exploitability describes the effort or access an attacker needs after reaching that code. These signals can adjust a finding's severity:
AI Deep Scan establishes External reachability only from a complete caller chain that starts at a named public API or framework entry point, ends at the sink, and is confirmed in source. Incomplete, ambiguous, historical, heuristic, or integrity-degraded relationship evidence remains a planning lead and cannot establish reachability.
| Signal | Severity effect |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| External reachability | No change |
| Internal reachability | Usually reduced by one level; capped at low when repository topology identifies the service as internal-only with high confidence |
| Unreachable | Capped at low |
| Unknown reachability | No change |
| Trivial or Moderate exploitability | No change |
| Difficult exploitability | Reduced by one level |
| Theoretical exploitability | Capped at low |
| Unknown exploitability | No change |
AI Deep Scan normally reports new findings only when verification establishes External or Internal reachability. Older findings can also show Unreachable or Unknown reachability; Unknown means CodeRabbit could not determine a path, not that the issue is exploitable.
## Configure repository scans
From **Security > Repositories**, select a repository and open **Settings** to configure its scan behavior.
### Branch and exclusions
For GitHub repositories, choose the branch CodeRabbit should scan. **Provider default** follows the repository default branch. If a custom branch is deleted, select another branch or return to the provider default before running the next scan.
Use excluded paths to skip files and directories for a specific scan type. **Path Exclude Filters** appear under **AI Deep Scan** and **Secrets Scanner** on the Settings tab. You can configure exclusions for any scan type, including Dependencies and SBOM, from **Configuration > Excluded paths** in the **Run security scan** dialog; CodeRabbit saves them when the scan starts.
| Path input | Rule |
| --------------- | -------------------------------------------------------------------------------------------------------- |
| Excluded paths | One repository-relative path or glob per line, with up to 100 entries for each scan type in a repository |
| Length | Up to 512 characters per path |
| Rejected values | Absolute paths, parent traversal such as `..`, and control characters |
| Normalization | Backslashes become `/`, a leading `./` is removed, and duplicate entries are ignored |
### Repository context
Repository context is optional architecture and business-domain background that helps AI Deep Scan interpret the repository. Enter context directly, or describe information to retrieve from your organization's connected data sources, such as Notion documents or Datadog dashboards. CodeRabbit can use relevant tools exposed by connected MCP servers to retrieve this information; see [Integrate MCP servers](/integrations/mcp-servers) to set them up. Enter up to 4,000 characters in **AI Deep Scan > Context**. The saved context applies to subsequent AI Deep Scans for that repository.
Leaving the field empty removes the saved context. Context helps CodeRabbit interpret the codebase, but it cannot override scan instructions; security-relevant claims are still checked against repository evidence.
#### Custom Path Instructions
Use **AI Deep Scan > Custom Path Instructions** to create, edit, and delete saved Custom Path Instructions for specific files or directories without excluding them from analysis. Each entry pairs a repository-relative path or glob, such as `src/auth/**`, with an instruction that applies only when AI Deep Scan analyzes matching files.
You can save up to 100 path instructions per repository. Each instruction can contain up to 4,000 characters, and its path follows the same validation rules as an excluded path.
Viewing Custom Path Instructions requires Security read access. Creating and editing require Security write access, and deleting requires Security delete access.
### Recurring schedules
For GitHub repositories, you can set one recurring weekly schedule per repository. Choose one or more days, a time in 24-hour format, an IANA timezone, and one or more scan types: Code (AI Deep Scan), Dependencies, SBOM, or Secrets.
At the scheduled time, each selected scan type starts independently. If one scan type is already active or is blocked by access or fair-use limits, CodeRabbit skips it without preventing the other selected scans from starting.
Scheduled AI Deep Scans require an available free allowance or enabled usage billing. Because a scheduled run cannot ask you to approve an overage, it does not continue when its estimate exceeds the remaining monthly cap. See [Usage and limits](#usage-and-limits).
### Secrets scan options
Secrets scans verify detected credentials against their service providers by default. Turn on **Disable Verification** to skip these checks. Disabling verification can reduce scan time, but more findings may have an **Unknown** verification status.
| Status | Meaning |
| ----------------- | ----------------------------------------------------------- |
| Verified Active | The credential is currently live |
| Verified Inactive | The credential is invalid or has been revoked |
| Unknown | Verification data is missing, unrecognized, or inconclusive |
Filter the Secrets findings list by verification status to prioritize credentials confirmed to be live.
#### Scan Git History for secrets
**Scan Git History** is available on all supported providers under **Security > Repositories > Settings > Secrets Scanner**. It applies only to Secrets scans and is disabled by default.
When enabled, Secrets Scanner inspects commits reachable from the configured scan branch and surfaces credentials that existed in earlier commits but are absent from the latest code. Enabling it can materially increase scan duration.
Historical secret findings show the source commit where the secret was detected. Code context loads from that commit rather than the latest scan state.
## Triage and remediate findings
### Filter, share, and export
* **Overview** — a dashboard of your latest security posture.
* **Repositories** — repository scan settings, including branch, path exclusions, and schedules.
* **Learnings** — saved accepted-risk guidance for CodeRabbit Security scans in each repository.
* **Agent Findings** — code vulnerability findings from CodeRabbit Security.
* **Dependencies** — vulnerable dependency findings. If this surface has no data, run a dependency scan.
* **SBOM** — resolved component inventory and license visibility. If this surface has no data, generate an SBOM.
* **Secrets Detection** — leaked secrets and hardcoded credential findings.
* **PR Findings** — security issues raised during pull request reviews.
* **Activity Log** — a record of scan runs.
The **Agent Findings** page lets you filter AI Deep Scan findings by repository, severity, category, status, subsystem, and search text. Open a finding to inspect its evidence, recommendation, reachability, exploitability, code context, and available actions.
From **Share**, choose **For humans** to copy a direct link or **For agents** to copy self-contained Markdown with the finding details and recommendation. Agent-ready sharing is available for AI Deep Scan, Dependency, and Secrets findings.
| Results | Export formats | Export scope |
| ------------ | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| AI Deep Scan | CSV, JSON, SARIF, and PDF | CSV, JSON, and SARIF include all findings in the selected repository scope; PDF reflects the current filters |
| Dependencies | CSV, JSON, and SARIF | All findings in the selected repository scope |
| SBOM | CycloneDX JSON, CycloneDX XML, SPDX JSON, and CSV | All components in the selected repository scope |
| Secrets | No export | Not applicable |
### Dismiss finding and Learnings
Open **Dismiss finding** from a finding's table-row actions or detail-drawer actions. It provides three options for AI Deep Scan findings:
* **Ignore this finding** — Marks the current finding as ignored without saving guidance.
* **Create a learning** — Saves suppression guidance for future scans with an **Auto**, **Current file**, or **Entire repository** scope. Auto infers the scope and defaults to the current file when unclear.
* **Create a path instruction** — Saves guidance for a repository-relative path or glob.
Creating a learning or path instruction does not dismiss the current finding. In later scans, CodeRabbit applies a learning only when the finding's behavior and scope match. File-scoped Learnings apply only to the exact repository-relative file, repository-scoped Learnings apply across the repository, and path instructions apply to files that match their configured path or glob. Dependency and Secrets findings can be dismissed and, when eligible, resolved with required context, but they do not support creating Learnings or path instructions.
The repository's **Learnings** tab lists up to 100 of its newest Security Learnings with their guidance, file scope, and last-updated time. Repository-wide guidance displays **All files**. You can edit or delete saved entries; these Security Learnings are separate from the [Learnings used in pull request reviews](/knowledge-base/learnings).
Viewing Security Learnings requires Security read access. Editing requires Security write access, and deleting requires Security delete access.
### Resolve finding
**Resolve finding** is separate from **Dismiss finding** and applies to eligible vulnerabilities, dependency groups, and customer-visible secret findings. Enter non-blank supporting context of up to 10,000 characters, such as a pull request URL or an explanation of the fix.
After a successful resolution, CodeRabbit marks the finding as resolved, records when and how it was resolved, and removes it from the active findings view. Resolving a dependency group applies to every matching advisory in that group. A finding that is already resolved cannot be resolved again.
Ignored secret findings retain their separate reopen workflow; resolving a finding does not replace it.
| Scan target | Results surface | What it checks |
| ------------ | ----------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Code | Agent Findings | Code vulnerability findings from an AI Deep Scan |
| Secrets | Secrets Detection | Leaked secrets and hardcoded credential findings |
| Dependencies | Dependencies | Known vulnerable dependencies from supported manifests and lock files. If this surface has no data, run a dependency scan. |
| SBOM | SBOM | Resolved component inventory and license visibility. If this surface has no data, generate an SBOM. |
Resolving findings requires Security write access.
### Fix with AI
**Fix with AI** creates a pull request or merge request for supported AI Deep Scan, Dependency, and Secrets findings; CodeRabbit does not merge it automatically. Dependency fixes can group related findings into one change.
A new fix cannot start while another fix for the same finding or dependency group is pending or running. You can retry a failed fix and open the generated pull request or merge request when it is ready. Secret findings detected only in repository history are not eligible for Fix with AI.
## Usage and limits
### Plan coverage and legacy Security access
Advanced and Enterprise include continuous pull request security review. New standalone CodeRabbit Security trials and seat add-ons are not offered. Existing active Security trials and separately purchased Security add-ons remain supported for compatibility and can retain repository Security settings, recurring schedules, continuous posture updates, and Dependency, SBOM, and Secrets scans.
For organizations with a legacy paid Security add-on, Security coverage must include every Review seat. The person starting a Dependency, SBOM, Secrets, or AI Initial Scan must also have an assigned Review seat; this seat requirement does not apply to an active legacy Security trial.
### Fair-use limits
Dependency, SBOM, Secrets, and AI Initial Scans can each run up to three times per repository per day. AI Initial Scans, which establish the repository's Attack Surface map without running an AI Deep Scan, also have a limit of 10 runs per repository in a 30-day window. AI Deep Scans are not subject to these per-repository fair-use limits.
When an allowance is exhausted, CodeRabbit does not start the scan and tells you how long to wait before retrying. On a recurring schedule, one blocked scan type does not prevent other selected scan types from starting.
### AI Deep Scan estimates and billing
AI Deep Scan is usage-based and is not included with Advanced, Enterprise, a legacy Security trial, or a legacy Security add-on. Some organizations can have a separate free allowance. After that allowance is used, or when no allowance is available, someone with Subscription write access must enable AI Deep Scan usage billing.
Before a scan starts, CodeRabbit estimates the required credits from the scannable files on the effective branch after applying saved AI Deep Scan path exclusions. If the estimate exceeds the organization's remaining monthly cap, a manually started scan can be canceled or confirmed as overage. Users with Subscription write access can also update the cap. Scheduled scans cannot request overage confirmation and do not continue above the cap; estimates from pending and running scans count toward the remaining cap.
When usage billing applies, the final charge is based on actual scan usage and is recorded after the scan finishes with a **Completed** or **Partial** status. Credit estimates are not final invoices.
## What's next
Assess the security implications of architecture-level changes in a pull request.
Map how a pull request's changes connect to dependencies, downstream consumers, and tests.
Explore the layer-by-layer PR interface where Security Architecture Review and Blast Radius appear.