# See how careful to be before a change ships

Every review scores a pull request's risk from 0 to 100 and says why, shows which changed code your tests miss, and flags migrations and API changes that can break production.

[Start free trial](https://app.mergeharbor.com/signup) [Read the docs](https://mergeharbor.com/docs/change-risk)

mergeharbor bot An illustrative review summary

Change risk: High (62/100)

· touches database migrations · 1 earlier revert touched these files in the last year

Tests · Partial() in pay/refund.go has no test

Migration · migration.drop-column · invoices.legacy\_total is dropped while the previous release still reads it

## How it works

1.  ### Collect the signals

    Blast radius, hot spots, past reverts, Sentry errors, sensitive areas, size, missing tests and open serious findings.

2.  ### Score and explain

    The pull request gets a score and a level from Low to Critical, with each signal that added points and the evidence behind it. An open critical finding makes it at least High.

3.  ### Plan the release

    The release radar shows open and merged changes headed for your next release, grouped by repository and sorted by risk.

## What you get

No extra cost

Risk scoring uses data MergeHarbor already has. It makes no extra model calls and uses no credits.

Gaps are never hidden

When the data behind a signal is not available, it adds nothing and the console says it was not checked, so a low score never hides a gap.

Test gaps on changed code

Upload LCOV, Cobertura, Go or JaCoCo coverage to see which changed lines ran, or get an estimate with no setup. Changed functions without tests are noted.

Write the missing tests

Select Write tests for one function or all untested ones. With proof runs on, MergeHarbor runs them in a sandbox first.

Migrations and API contracts

Built-in rules catch migrations that lock or lose data and contract changes that break clients, and name the repositories that use the contract.

Weights that fit your priorities

Choose Balanced, Stability first or Security first, or set your own weight per signal. Weight changes are recorded in the audit log.

Documentation: [Change risk and release radar](https://mergeharbor.com/docs/change-risk) [Test gaps and coverage](https://mergeharbor.com/docs/test-gaps) [Migration and API safety](https://mergeharbor.com/docs/migration-and-api-safety)

## Frequently asked questions

Is change risk the same as the review's findings?

No. Findings say what is wrong with the code. Change risk says how careful to be when it ships: a small, correct change to a migration that was reverted last month can still deserve a careful rollout.

Which migration tools are checked?

Plain SQL migrations (dbmate, goose, golang-migrate, Flyway, Liquibase, Prisma) and Rails, Django, Alembic, Knex and TypeORM. Only the direction that runs on deploy is checked.

Can I get a weekly view of release risk?

Yes. Turn on the weekly release risk digest under Settings → Checks & gates → Change risk. On Monday mornings (UTC) it notifies people who can see analytics when high or critical changes are headed for a release.

Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support)

## Explore other features

### Merge gate

One safe-to-merge verdict with a checklist

[Merge gate](https://mergeharbor.com/features/merge-gate)

### Context connectors

Tickets, docs and production errors in reviews

[Context connectors](https://mergeharbor.com/features/context)

### Proof runs

Tests that reproduce findings in a sandbox

[Proof runs](https://mergeharbor.com/features/proof-runs)

## Review every pull request with the context of your whole codebase

Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.

[Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)