Skip to main content
|
Continuous pull request security review is included with Advanced and Enterprise plans. AI Deep Scan is usage-based and billed separately from the review plan.
CodeRabbit Security brings repository-level security analysis to CodeRabbit. Advanced and Enterprise include continuous pull request security review and its supported outputs, including Security Architecture Review and Security Blast Radius. AI Deep Scan is a separately metered scan that analyzes committed source code and infrastructure configuration for exploitable vulnerabilities and exposed secrets beyond the current pull request diff. AI Deep Scan results, including secret findings, appear under Security > Agent Findings, where you can inspect evidence, triage findings, export results, and start supported fixes. These findings are separate from Pull Requests > PR Findings, which come from security issues raised during pull request reviews. The Attack surface map organizes security-relevant code into subsystems and tracks verification coverage, findings, and drift as pull requests merge.
CodeRabbit Security findings are separate from Pull Requests > PR Findings. PR Findings come from security issues raised during pull request review comments, while Agent Findings come from an AI Deep Scan.

​
Security capabilities at a glance

AI Deep Scan does not perform dependency or software composition analysis (SCA) or generate a software bill of materials (SBOM).

​
PR Findings

Open Security > Pull Requests > PR Findings to review security issues raised during pull request reviews. Each finding shows its status and severity, plus separate Reachability and Exploitability badge columns.

​
PR Findings filters

Use the PR status filter to show All, Open, Merged, or Closed pull requests. Author is a searchable multi-select filter for choosing one or more pull request authors. Its menu continues to list all authors while filters are active, so you can switch authors without first clearing the current selection. Filters apply to the full organization-wide PR Findings result set before pagination, and the reported total reflects the filtered set. Changing either filter returns the list to page one and closes any open pull request detail. The PR status filter describes the lifecycle of a pull request. It is separate from the status of each individual security finding. If an active filter returns no results, PR Findings shows No pull requests match these filters. This is distinct from the existing empty state shown when the organization has no PR Findings.

​
Reachability tiers

​
Exploitability tiers

A dash means no valid tier was available from the live provider review comment. This can happen for older findings or provider responses without the enriched comment body.

​
Before you start

​
Supported providers

  • GitHub Cloud and GitHub Enterprise Server
  • GitLab Cloud and self-hosted GitLab
  • Azure DevOps Services
  • Bitbucket Cloud

​
Unsupported providers

  • Bitbucket Data Center
  • Azure DevOps Server (ADO Server)
Repository security settings, code context links, and Fix with AI are available on all supported providers. Custom scan branches and recurring AI Deep Scan schedules are currently available only for GitHub repositories.

​
Access and billing

  • Viewing Security requires Security read access. Running an AI Deep Scan requires Security write access, which organization admins have by default.
  • Advanced and Enterprise include continuous pull request security review.
  • AI Deep Scan is usage-based and is not included with Advanced or Enterprise. Some organizations can have a separate free allowance; otherwise, usage billing must be enabled.
For detailed usage and billing behavior, see Usage and limits.

​
Run an AI Deep Scan

Start one AI Deep Scan for one repository at a time from the Security area in CodeRabbit.
1

Open Security

In the CodeRabbit app, go to Security.
2

Start a scan

Click Scan repository.
3

Choose a repository

Select the supported repository you want to scan. You can scan one repository at a time. Provider-archived repositories do not appear in the repository selection after CodeRabbit records their archive state.
4

Choose AI Deep Scan

Under Scan type, select AI Deep Scan.
5

Review the estimate

If scan credits apply, review the estimated credits for the repository. The estimate uses the effective scan branch and saved AI Deep Scan path exclusions.
6

Start the scan

Click Scan now.
CodeRabbit does not start another AI Deep Scan while one is active for the same repository. Billing or monthly limit issues are shown before the scan starts; see Usage and limits. After starting the scan, open Security > Activity Log to track its progress and view its current status.

​
Track scan status

The Activity Log shows each scan’s type, status, repository, duration, who triggered it and when, and scan ID. A scan can appear as Pending, Running, Completed, Partial, or Failed. Completed describes the execution status. A completed AI Deep Scan can still show partial coverage and follow-up work when repository traversal or coverage analysis reaches a file cap. Select a Completed or Partial scan to open its findings and scan details. The details include the result summary, runtime, repository, trigger information, and full scan ID, which you can copy for troubleshooting. When viewing an older scan, select View latest findings to return to the repository’s latest results. Partial means the scan completed, but its results cover only the analyzed scope. The findings page explains why coverage was limited.

​
Understand AI Deep Scan

​
What it finds

AI Deep Scan looks for practical vulnerabilities across supported source and infrastructure files, including:
  • Authentication and access control — Authorization bypass, IDOR, broken authentication, and CSRF
  • Unsafe input and data handling — Injection, XSS, SSRF, open redirects, insecure deserialization, and path traversal
  • Sensitive data and configuration — Sensitive data exposure, information disclosure, CORS issues, weak cryptography, denial of service, and security misconfiguration
  • AI and LLM applications — Prompt injection, improper output handling, excessive agency, and other LLM security risks
  • Infrastructure as code — Misconfigurations in Terraform, OpenTofu, Kubernetes, Helm, Dockerfile, Containerfile, Bicep, CloudFormation, ARM templates, and Compose files
Infrastructure checks run automatically without additional setup. Repositories that contain only supported infrastructure files participate in the same analysis and verification workflow.

​
How it works

AI Deep Scan combines rule-based signals with AI reasoning across files, services, and infrastructure configuration:
  • Map — Inventories the repository, groups related code into subsystems, and maps security-relevant entry points, trust boundaries, controls, sinks, and configuration.
  • Investigate — Follows repository relationships from high-risk points to callers and supporting files, traces untrusted input to security-sensitive operations, and validates suspected infrastructure misconfigurations.
  • Verify — Reopens the cited code and configuration, checks the supporting evidence, and rejects duplicate, mitigated, speculative, test-only, dead-code, unreachable, or otherwise unsupported candidates.
Repository relationships provide advisory leads. AI Deep Scan reopens and confirms the cited source before reporting a finding. If relationship evidence is unavailable or unusable, the scan continues with source-driven analysis. Rule-based results are candidate signals rather than final findings. They must be confirmed against repository evidence before they are reported. This repository-wide reasoning can identify authorization bypass, IDOR, and other business-logic flaws that rule matching alone may miss.

​
Coverage and evidence

Coverage follows the repository’s scan settings. Configured path exclusions are skipped, and a completed scan can report partial coverage when analysis limits prevent every eligible area from being investigated. If analysis cannot reach a supported conclusion, AI Deep Scan records the remaining work instead of treating incomplete analysis as evidence that the repository is secure. Each reported finding cites repository evidence and can include:
  • Category, severity, and CWE
  • Repository, file path, line range, and subsystem
  • Description and recommendation
  • Reachability, exploitability, and a reachability call stack when available
  • Inline code context or a permalink to the scanned commit
  • Finding status and Fix with AI status
CodeRabbit Security does not prove that a repository has no vulnerabilities. Results reflect only the repository content and scope that CodeRabbit analyzed.

​
Reachability and exploitability

Reachability describes whether a path exists from untrusted input to risky code. Exploitability describes the effort or access an attacker needs after reaching that code. These signals can adjust a finding’s severity: AI Deep Scan establishes External reachability only from a complete caller chain that starts at a named public API or framework entry point, ends at the sink, and is confirmed in source. Incomplete, ambiguous, historical, heuristic, or integrity-degraded relationship evidence remains a planning lead and cannot establish reachability. AI Deep Scan normally reports new findings only when verification establishes External or Internal reachability. Older findings can also show Unreachable or Unknown reachability; Unknown means CodeRabbit could not determine a path, not that the issue is exploitable.

​
Configure AI Deep Scan

From Security > Repositories, select a repository and open Settings to configure its scan behavior.

​
Branch and exclusions

For GitHub repositories, choose the branch CodeRabbit should scan. Provider default follows the repository default branch. If a custom branch is deleted, select another branch or return to the provider default before running the next scan. Use AI Deep Scan > Path Exclude Filters to skip files and directories during AI Deep Scan analysis.

​
Repository context

Repository context is optional architecture and business-domain background that helps AI Deep Scan interpret the repository. Enter context directly, or describe information to retrieve from your organization’s connected data sources, such as Notion documents or Datadog dashboards. CodeRabbit can use relevant tools exposed by connected MCP servers to retrieve this information; see Integrate MCP servers to set them up. Enter up to 4,000 characters in AI Deep Scan > Context. The saved context applies to subsequent AI Deep Scans for that repository. Leaving the field empty removes the saved context. Context helps CodeRabbit interpret the codebase, but it cannot override scan instructions; security-relevant claims are still checked against repository evidence.

​
Custom Path Instructions

Use AI Deep Scan > Custom Path Instructions to create, edit, and delete saved Custom Path Instructions for specific files or directories without excluding them from analysis. Each entry pairs a repository-relative path or glob, such as src/auth/**, with an instruction that applies only when AI Deep Scan analyzes matching files. You can save up to 100 path instructions per repository. Each instruction can contain up to 4,000 characters, and its path follows the same validation rules as an excluded path.
Viewing Custom Path Instructions requires Security read access. Creating and editing require Security write access, and deleting requires Security delete access.

​
Recurring schedules

For GitHub repositories, you can set one recurring weekly AI Deep Scan schedule per repository. Choose one or more days, a time in 24-hour format, and an IANA timezone. Scheduled AI Deep Scans require an available free allowance or enabled usage billing. Because a scheduled run cannot ask you to approve an overage, it does not continue when its estimate exceeds the remaining monthly cap. See Usage and limits.

​
Triage and remediate findings

​
Filter, share, and export

  • Overview — a dashboard of your latest security posture.
  • Repositories — repository scan settings, including branch, path exclusions, and schedules.
  • Learnings — saved accepted-risk guidance for CodeRabbit Security scans in each repository.
  • Agent Findings — AI Deep Scan vulnerability and secret findings.
  • PR Findings — security issues raised during pull request reviews.
  • Activity Log — a record of scan runs.
The Agent Findings page lets you filter AI Deep Scan findings by repository, severity, category, status, subsystem, and search text. Open a finding to inspect its evidence, recommendation, reachability, exploitability, code context, and available actions. From Share, choose For humans to copy a direct link or For agents to copy self-contained Markdown with the finding details and recommendation.

​
Dismiss finding and Learnings

Open Dismiss finding from a finding’s table-row actions or detail-drawer actions. It provides three options for AI Deep Scan findings:
  • Ignore this finding — Marks the current finding as ignored without saving guidance.
  • Create a learning — Saves suppression guidance for future scans with an Auto, Current file, or Entire repository scope. Auto infers the scope and defaults to the current file when unclear.
  • Create a path instruction — Saves guidance for a repository-relative path or glob.
Creating a learning or path instruction does not dismiss the current finding. In later scans, CodeRabbit applies a learning only when the finding’s behavior and scope match. File-scoped Learnings apply only to the exact repository-relative file, repository-scoped Learnings apply across the repository, and path instructions apply to files that match their configured path or glob. The repository’s Learnings tab lists up to 100 of its newest Security Learnings with their guidance, file scope, and last-updated time. Repository-wide guidance displays All files. You can edit or delete saved entries; these Security Learnings are separate from the Learnings used in pull request reviews.
Viewing Security Learnings requires Security read access. Editing requires Security write access, and deleting requires Security delete access.

​
Resolve finding

Resolve finding is separate from Dismiss finding and applies to eligible AI Deep Scan vulnerabilities. Enter non-blank supporting context of up to 10,000 characters, such as a pull request URL or an explanation of the fix. After a successful resolution, CodeRabbit marks the finding as resolved, records when and how it was resolved, and removes it from the active findings view. A finding that is already resolved cannot be resolved again.
Resolving findings requires Security write access.

​
Fix with AI

Fix with AI creates a pull request or merge request for supported AI Deep Scan findings; CodeRabbit does not merge it automatically. A new fix cannot start while another fix for the same finding is pending or running. You can retry a failed fix and open the generated pull request or merge request when it is ready.

​
Usage and limits

​
Plan coverage

Advanced and Enterprise include continuous pull request security review. AI Deep Scan uses separate usage-based billing.

​
AI Deep Scan estimates and billing

AI Deep Scan is usage-based and is not included with Advanced or Enterprise. Some organizations can have a separate free allowance. After that allowance is used, or when no allowance is available, someone with Subscription write access must enable AI Deep Scan usage billing. Before a scan starts, CodeRabbit estimates the required credits from the scannable files on the effective branch after applying saved AI Deep Scan path exclusions. If the estimate exceeds the organization’s remaining monthly cap, a manually started scan can be canceled or confirmed as overage. Users with Subscription write access can also update the cap. Scheduled scans cannot request overage confirmation and do not continue above the cap; estimates from pending and running scans count toward the remaining cap. When usage billing applies, the final charge is based on actual scan usage and is recorded after the scan finishes with a Completed or Partial status. Credit estimates are not final invoices.

​
What’s next

Attack surface

Understand how CodeRabbit maps security-relevant code and keeps verification posture current as pull requests merge.

Architecture Review

Assess the security implications of architecture-level changes in a pull request.

Change Stack

Explore the layer-by-layer PR interface where Security Architecture Review and Blast Radius appear.