Security scans

Reviews look at one pull request. A security scan looks at the whole default branch: code that was merged before MergeHarbor was installed, dependencies that became vulnerable after they were added, and secrets that are still in the history.

Open Security → Coverage. It lists every repository with its coverage, open findings and last full scan; choose one and select Run scan. The dialog shows how many credits the scan will use before anything runs.

The Security area

Security in the sidebar is code and application security. Dependency, license and risky-dependency findings are in Vulnerabilities (vulnerability management).

Section	What it is for
Overview	Before the first scan, one step: Run full scan. After it: open critical and high findings, attack-surface coverage, drift, the latest scan and the five findings to fix first.
Findings	Code vulnerabilities, secrets and AI findings, filtered by category (OWASP Top 10), repository, module (a path), state, how they were fixed and severity. When some repositories have no full scan yet, the list says how many.
Coverage	Repositories mapped, verified surface and repositories below the target, then every repository with its open findings, coverage, drift, when it was last mapped and fully scanned, and its scan state. Filter to Not scanned yet or Below the coverage target; choose one for its scans and surface.
PR reviews	For a range (90 days by default): pull requests reviewed, accepted findings and the acceptance rate (the Insights definition), unaddressed high and critical, and breakdowns; then secrets detected, time to fix, findings by weakness and OWASP Top 10 category over time, and repositories ranked.
Scans	Scan history: whole-repository scans and pull request reviews with scope, coverage, status, duration, credits and cost, and what triggered them.
Settings	The coverage target (80% by default) and an optional cost per finding.

Coverage is the share of a repository’s mapped entry points whose protection the scan determined (an auth guard, a verified signature, or explicitly public) rather than unknown. Drift counts entry points that pull request reviews found in changed files since the repository’s last full scan and that the scan had not mapped; a full scan resets it. Repositories without a full scan have no baseline, so no drift.

Reachability in PR reviews says whether a finding’s file holds a mapped entry point; exploitability says what verification found (confirmed, inconclusive, refuted or not verified).

Estimated cost avoided appears only when you set your own cost of one high or critical issue reaching production in Security → Settings. It is accepted high and critical findings × that figure. MergeHarbor supplies no default: published figures vary widely by industry and incident type, so use your own incident data or a source your security team trusts, and keep it conservative.

What a scan checks

• Secrets. Credentials at the head of the default branch and in the most recent commits (200 by default). A secret removed from the code is still in the history, so these findings are never closed automatically: rotate the secret, then mark the finding fixed.
• Vulnerable dependencies. Lockfiles and pinned manifests (package-lock.json, yarn.lock, pnpm-lock.yaml, go.mod, requirements*.txt, Pipfile.lock, poetry.lock, uv.lock, Cargo.lock, Gemfile.lock, composer.lock) are checked against the OSV vulnerability database. Only package names and versions are sent.
• Risky configuration. GitHub Actions workflows (script injection, pull_request_target checking out untrusted code, write-all tokens, unpinned actions), Dockerfiles (running as root, piping downloads into a shell, secrets in the image), Terraform (internet-facing ingress, public buckets and databases, encryption off) and Kubernetes manifests (privileged containers, host namespaces).
• Dangerous code patterns. SQL and shell commands built from strings, unsafe deserialization, requests to user-supplied URLs, file paths from request input, open redirects, weak ciphers and password hashes, unverified JWTs, and debug mode.
• AI review of the riskiest code. The files that matter most are picked from the code graph: authentication, payments, input handling, deserialization, outbound requests, injection sinks and cryptography, ranked by how many callers depend on them. Cheap models do the first pass; a stronger model is used only to settle uncertain high-severity findings.

Scans read files and history only. They never install dependencies or run repository code.

Every finding is checked twice

A finding is shown only after a second check: a stricter re-check of the rule on the exact line, the advisory’s affected version ranges for dependencies, or the AI verifier for model findings. Each finding says which check it passed.

Findings

Each finding has a severity (critical, high, medium, low), a CWE and an OWASP Top 10 category, the file and line with the evidence, and a fix. Findings keep their identity across scans, so their status carries over:

• Open until a scan no longer finds them where it looked, or you mark them fixed.
• Fixed when the code is gone. A fixed finding that comes back is reopened.
• Accepted risk, with a reason that is recorded with your name. It stays accepted while it is still found.

When a finding has a code suggestion, Open fix PR pushes a branch with the change and opens a pull request into the default branch after you confirm. This needs the pulls.fix permission and a GitHub repository connected through the MergeHarbor GitHub App.

Before anything is pushed, MergeHarbor checks the change. A suggestion that rewrites a whole function replaces that function, not just the lines the finding cites, and the changed file must parse: Go with the Go parser, and Python, TypeScript, JavaScript, Java, C#, C, C++, Rust, Ruby, Kotlin, PHP, Scala, Swift and shell with their tree-sitter grammars. If the change would break the file, no pull request is opened: the finding says the fix couldn’t be applied safely and why, and offers to copy the suggestion or ask Shipyard to make the fix. The pull request description says which check ran. MergeHarbor doesn’t build the project or add tests, so run your tests before merging.

Export findings as SARIF 2.1.0 or CSV from the Findings tab. To upload results to GitHub code scanning after each scan, turn on Upload to GitHub code scanning in the scan settings; the GitHub App needs the Code scanning alerts: read and write permission. It is off by default.

Attack surface

Security → Coverage shows how many repositories are mapped, the share of entry points whose protection the scan determined, and drift since each last full scan; choosing a repository there lists the entry points the latest scan found (HTTP routes, webhooks, queue consumers, command-line commands, gRPC services and GraphQL roots) with the auth requirement detected at each: auth required, signature checked, public, or not detected. Public and undetected entries are listed first.

Scan history

Every scan records what changed: new, reopened, fixed and still-open findings. Open a scan from the Scan history tab to see its diff.

Schedules and cost

Scans run on demand. In Scan settings you can schedule them daily, weekly or monthly (off by default). Scheduled scans are incremental, looking only at what changed since the last scan, except every fourth one (configurable), which is a full scan. Dependencies are rechecked on every scan because new advisories appear daily.

Deterministic checks are free. The AI pass costs one credit per batch of high-risk files and is limited by:

• the credits per scan (10 by default),
• the repository’s credits per month (40 by default),
• your organization’s credit budget and spend limit.

Files the AI pass already reviewed are not sent again while they are unchanged. Turn the AI pass off to run only the free checks.

Alerts

A new or reopened critical finding raises the New critical security finding event. Add it to a notification rule under Settings → Alerts & webhooks to receive it in Slack, Microsoft Teams, Google Chat or email.

Permissions

Action	Permission
View findings, attack surface, history and exports	repos.read
Run or cancel a scan, change a finding’s status	repos.manage
Change scan settings	settings.manage
Open a fix pull request	pulls.fix