Security Agent

| Security Agent brings repository-level security analysis to CodeRabbit. Advanced and Enterprise include continuous pull request security review and its supported outputs, including Security Architecture Review and Security Blast Radius. AI Deep Scan is a separately metered scan that analyzes committed source code and infrastructure configuration for exploitable vulnerabilities beyond the current pull request diff. Repository security settings, recurring scans, continuous posture, and Dependency, SBOM, and Secrets scans use separate eligibility described below. AI Deep Scan results appear under Security > Agent Findings, where you can inspect evidence, triage findings, export results, and start supported fixes. These findings are separate from Pull Requests > PR Findings, which come from security issues raised during pull request reviews.

​

Security capabilities at a glance

Security Agent offers two code-scan tiers. An AI Initial Scan is the lighter entry-point scan that builds the repository security posture map without running an AI Deep Scan.

​

PR Findings

Open Security > Pull Requests > PR Findings to review security issues raised during pull request reviews. Each finding shows its status and severity, plus separate Reachability and Exploitability badge columns.

​

PR Findings filters

Use the PR status filter to show All, Open, Merged, or Closed pull requests. Author is a searchable multi-select filter for choosing one or more pull request authors. Its menu continues to list all authors while filters are active, so you can switch authors without first clearing the current selection. Filters apply to the full organization-wide PR Findings result set before pagination, and the reported total reflects the filtered set. Changing either filter returns the list to page one and closes any open pull request detail. The PR status filter describes the lifecycle of a pull request. It is separate from the status of each individual security finding. If an active filter returns no results, PR Findings shows No pull requests match these filters. This is distinct from the existing empty state shown when the organization has no PR Findings.

​

Reachability tiers

​

Exploitability tiers

A dash means no valid tier was available from the live provider review comment. This can happen for older findings or provider responses without the enriched comment body.

​

Before you start

​

Supported providers

• GitHub Cloud and GitHub Enterprise Server
• GitLab Cloud and self-hosted GitLab
• Azure DevOps Services
• Bitbucket Cloud

​

Unsupported providers

• Bitbucket Data Center
• Azure DevOps Server (ADO Server)

Repository security settings, code context links, and Fix with AI are available on all supported providers. Custom scan branches and recurring schedules are currently available only for GitHub repositories.

​

Access and billing

• Viewing Security requires Security read access. Running an AI Deep Scan requires Security write access, which organization admins have by default.
• Advanced and Enterprise include continuous pull request security review. Existing active Security trials and legacy Security add-ons remain supported for compatibility.
• Repository Security settings, recurring schedules, continuous posture updates, and Dependency, SBOM, and Secrets scans require separate premium Security eligibility, such as an active legacy Security trial or add-on. Eligible open-source organizations can also receive this access.
• AI Deep Scan is usage-based and is not included with Advanced, Enterprise, a legacy Security trial, or a legacy Security add-on. Some organizations can have a separate free allowance; otherwise, usage billing must be enabled.

For detailed trial, seat, billing, and fair-use behavior, see Usage and limits.

​

Run an AI Deep Scan

Start one AI Deep Scan for one repository at a time from the Security area in CodeRabbit. CodeRabbit does not start another AI Deep Scan while one is active for the same repository. Billing or monthly limit issues are shown before the scan starts; see Usage and limits. After starting the scan, open Security > Activity Log to track its progress and view its current status.

​

Track scan status

The Activity Log shows each scan’s type, status, repository, duration, who triggered it and when, and scan ID. A scan can appear as Pending, Running, Completed, Partial, or Failed. Completed describes the execution status. A completed AI Deep Scan can still show partial coverage and follow-up work when repository traversal or coverage analysis reaches a file cap. Select a Completed or Partial scan to open its findings and scan details. The details include the result summary, runtime, repository, trigger information, and full scan ID, which you can copy for troubleshooting. When viewing an older scan, select View latest findings to return to the repository’s latest results. Partial means the scan completed, but its results cover only the analyzed scope. The findings page explains why coverage was limited.

​

Understand AI Deep Scan

​

What it finds

AI Deep Scan looks for practical vulnerabilities across supported source and infrastructure files, including:

• Authentication and access control — Authorization bypass, IDOR, broken authentication, and CSRF
• Unsafe input and data handling — Injection, XSS, SSRF, open redirects, insecure deserialization, and path traversal
• Sensitive data and configuration — Sensitive data exposure, information disclosure, CORS issues, weak cryptography, denial of service, and security misconfiguration
• AI and LLM applications — Prompt injection, improper output handling, excessive agency, and other LLM security risks
• Infrastructure as code — Misconfigurations in Terraform, OpenTofu, Kubernetes, Helm, Dockerfile, Containerfile, Bicep, CloudFormation, ARM templates, and Compose files

Infrastructure checks run automatically without additional setup. Repositories that contain only supported infrastructure files participate in the same analysis and verification workflow.

​

How it works

AI Deep Scan combines rule-based signals with AI reasoning across files, services, and infrastructure configuration:

• Map — Inventories the repository, groups related code into subsystems, and maps security-relevant entry points, trust boundaries, controls, sinks, and configuration.
• Investigate — Follows repository relationships from high-risk points to callers and supporting files, traces untrusted input to security-sensitive operations, and validates suspected infrastructure misconfigurations.
• Verify — Reopens the cited code and configuration, checks the supporting evidence, and rejects duplicate, mitigated, speculative, test-only, dead-code, unreachable, or otherwise unsupported candidates.

Repository relationships provide advisory leads. AI Deep Scan reopens and confirms the cited source before reporting a finding. If relationship evidence is unavailable or unusable, the scan continues with source-driven analysis. Rule-based results are candidate signals rather than final findings. They must be confirmed against repository evidence before they are reported. This repository-wide reasoning can identify authorization bypass, IDOR, and other business-logic flaws that rule matching alone may miss.

​

Coverage and evidence

Coverage follows the repository’s scan settings. Configured path exclusions are skipped, and a completed scan can report partial coverage when analysis limits prevent every eligible area from being investigated. If analysis cannot reach a supported conclusion, AI Deep Scan records the remaining work instead of treating incomplete analysis as evidence that the repository is secure. Each reported finding cites repository evidence and can include:

• Category, severity, and CWE
• Repository, file path, line range, and subsystem
• Description and recommendation
• Reachability, exploitability, and a reachability call stack when available
• Inline code context or a permalink to the scanned commit
• Finding status and Fix with AI status

Security Agent does not prove that a repository has no vulnerabilities. Results reflect only the repository content and scope that CodeRabbit analyzed.

​

Reachability and exploitability

Reachability describes whether a path exists from untrusted input to risky code. Exploitability describes the effort or access an attacker needs after reaching that code. These signals can adjust a finding’s severity: AI Deep Scan establishes External reachability only from a complete caller chain that starts at a named public API or framework entry point, ends at the sink, and is confirmed in source. Incomplete, ambiguous, historical, heuristic, or integrity-degraded relationship evidence remains a planning lead and cannot establish reachability. AI Deep Scan normally reports new findings only when verification establishes External or Internal reachability. Older findings can also show Unreachable or Unknown reachability; Unknown means CodeRabbit could not determine a path, not that the issue is exploitable.

​

Configure repository scans

From Security > Repositories, select a repository and open Settings to configure its scan behavior.

​

Branch and exclusions

For GitHub repositories, choose the branch CodeRabbit should scan. Provider default follows the repository default branch. If a custom branch is deleted, select another branch or return to the provider default before running the next scan. Use excluded paths to skip files and directories for a specific scan type. Path Exclude Filters appear under AI Deep Scan and Secrets Scanner on the Settings tab. You can configure exclusions for any scan type, including Dependencies and SBOM, from Configuration > Excluded paths in the Run security scan dialog; CodeRabbit saves them when the scan starts.

​

Repository context

Repository context is optional architecture and business-domain background that helps AI Deep Scan interpret the repository. Enter context directly, or describe information to retrieve from your organization’s connected data sources, such as Notion documents or Datadog dashboards. CodeRabbit can use relevant tools exposed by connected MCP servers to retrieve this information; see Integrate MCP servers to set them up. Enter up to 4,000 characters in AI Deep Scan > Context. The saved context applies to subsequent AI Deep Scans for that repository. Leaving the field empty removes the saved context. Context helps CodeRabbit interpret the codebase, but it cannot override scan instructions; security-relevant claims are still checked against repository evidence.

​

Custom Path Instructions

Use AI Deep Scan > Custom Path Instructions to create, edit, and delete saved Custom Path Instructions for specific files or directories without excluding them from analysis. Each entry pairs a repository-relative path or glob, such as src/auth/**, with an instruction that applies only when AI Deep Scan analyzes matching files. You can save up to 100 path instructions per repository. Each instruction can contain up to 4,000 characters, and its path follows the same validation rules as an excluded path.

​

Recurring schedules

For GitHub repositories, you can set one recurring weekly schedule per repository. Choose one or more days, a time in 24-hour format, an IANA timezone, and one or more scan types: Code (AI Deep Scan), Dependencies, SBOM, or Secrets. At the scheduled time, each selected scan type starts independently. If one scan type is already active or is blocked by access or fair-use limits, CodeRabbit skips it without preventing the other selected scans from starting. Scheduled AI Deep Scans require an available free allowance or enabled usage billing. Because a scheduled run cannot ask you to approve an overage, it does not continue when its estimate exceeds the remaining monthly cap. See Usage and limits.

​

Secrets scan options

Secrets scans verify detected credentials against their service providers by default. Turn on Disable Verification to skip these checks. Disabling verification can reduce scan time, but more findings may have an Unknown verification status. Filter the Secrets findings list by verification status to prioritize credentials confirmed to be live.

​

Scan Git History for secrets

Scan Git History is available on all supported providers under Security > Repositories > Settings > Secrets Scanner. It applies only to Secrets scans and is disabled by default. When enabled, Secrets Scanner inspects commits reachable from the configured scan branch and surfaces credentials that existed in earlier commits but are absent from the latest code. Enabling it can materially increase scan duration. Historical secret findings show the source commit where the secret was detected. Code context loads from that commit rather than the latest scan state.

​

Triage and remediate findings

​

Filter, share, and export

• Overview — a dashboard of your latest security posture.
• Repositories — repository scan settings, including branch, path exclusions, and schedules.
• Learnings — saved accepted-risk guidance for Security Agent scans in each repository.
• Agent Findings — code vulnerability findings from Security Agent.
• Dependencies — vulnerable dependency findings. If this surface has no data, run a dependency scan.
• SBOM — resolved component inventory and license visibility. If this surface has no data, generate an SBOM.
• Secrets Detection — leaked secrets and hardcoded credential findings.
• PR Findings — security issues raised during pull request reviews.
• Activity Log — a record of scan runs.

The Agent Findings page lets you filter AI Deep Scan findings by repository, severity, category, status, subsystem, and search text. Open a finding to inspect its evidence, recommendation, reachability, exploitability, code context, and available actions. From Share, choose For humans to copy a direct link or For agents to copy self-contained Markdown with the finding details and recommendation. Agent-ready sharing is available for AI Deep Scan, Dependency, and Secrets findings.

​

Dismiss finding and Learnings

Open Dismiss finding from a finding’s table-row actions or detail-drawer actions. It provides three options for AI Deep Scan findings:

• Ignore this finding — Marks the current finding as ignored without saving guidance.
• Create a learning — Saves suppression guidance for future scans with an Auto, Current file, or Entire repository scope. Auto infers the scope and defaults to the current file when unclear.
• Create a path instruction — Saves guidance for a repository-relative path or glob.

Creating a learning or path instruction does not dismiss the current finding. In later scans, CodeRabbit applies a learning only when the finding’s behavior and scope match. File-scoped Learnings apply only to the exact repository-relative file, repository-scoped Learnings apply across the repository, and path instructions apply to files that match their configured path or glob. Dependency and Secrets findings can be dismissed and, when eligible, resolved with required context, but they do not support creating Learnings or path instructions. The repository’s Learnings tab lists up to 100 of its newest Security Learnings with their guidance, file scope, and last-updated time. Repository-wide guidance displays All files. You can edit or delete saved entries; these Security Learnings are separate from the Learnings used in pull request reviews.

​

Resolve finding

Resolve finding is separate from Dismiss finding and applies to eligible vulnerabilities, dependency groups, and customer-visible secret findings. Enter non-blank supporting context of up to 10,000 characters, such as a pull request URL or an explanation of the fix. After a successful resolution, CodeRabbit marks the finding as resolved, records when and how it was resolved, and removes it from the active findings view. Resolving a dependency group applies to every matching advisory in that group. A finding that is already resolved cannot be resolved again. Ignored secret findings retain their separate reopen workflow; resolving a finding does not replace it.

​

Fix with AI

Fix with AI creates a pull request or merge request for supported AI Deep Scan, Dependency, and Secrets findings; CodeRabbit does not merge it automatically. Dependency fixes can group related findings into one change. A new fix cannot start while another fix for the same finding or dependency group is pending or running. You can retry a failed fix and open the generated pull request or merge request when it is ready. Secret findings detected only in repository history are not eligible for Fix with AI.

​

Usage and limits

​

Plan coverage and legacy Security access

Advanced and Enterprise include continuous pull request security review. New standalone Security Agent trials and seat add-ons are not offered. Existing active Security trials and separately purchased Security add-ons remain supported for compatibility and can retain repository Security settings, recurring schedules, continuous posture updates, and Dependency, SBOM, and Secrets scans. For organizations with a legacy paid Security add-on, Security coverage must include every Review seat. The person starting a Dependency, SBOM, Secrets, or AI Initial Scan must also have an assigned Review seat; this seat requirement does not apply to an active legacy Security trial.

​

Fair-use limits

Dependency, SBOM, Secrets, and AI Initial Scans can each run up to three times per repository per day. AI Initial Scans, which establish the repository’s Attack Surface map without running an AI Deep Scan, also have a limit of 10 runs per repository in a 30-day window. AI Deep Scans are not subject to these per-repository fair-use limits. When an allowance is exhausted, CodeRabbit does not start the scan and tells you how long to wait before retrying. On a recurring schedule, one blocked scan type does not prevent other selected scan types from starting.

​

AI Deep Scan estimates and billing

AI Deep Scan is usage-based and is not included with Advanced, Enterprise, a legacy Security trial, or a legacy Security add-on. Some organizations can have a separate free allowance. After that allowance is used, or when no allowance is available, someone with Subscription write access must enable AI Deep Scan usage billing. Before a scan starts, CodeRabbit estimates the required credits from the scannable files on the effective branch after applying saved AI Deep Scan path exclusions. If the estimate exceeds the organization’s remaining monthly cap, a manually started scan can be canceled or confirmed as overage. Users with Subscription write access can also update the cap. Scheduled scans cannot request overage confirmation and do not continue above the cap; estimates from pending and running scans count toward the remaining cap. When usage billing applies, the final charge is based on actual scan usage and is recorded after the scan finishes with a Completed or Partial status. Credit estimates are not final invoices.

​

What’s next