# Review findings backed by a failing test

After a review, MergeHarbor writes small tests that try to reproduce its findings, runs them in an isolated sandbox against your pull request, and attaches the evidence to the findings it proves.

[Start free trial](https://app.mergeharbor.com/signup) [Read the docs](https://mergeharbor.com/docs/proof-runs)

.mergeharbor/sandbox.yml

```
version: 1
language: python
install: pip install -r requirements-dev.txt
test:
  command: pytest -q
  run_one: pytest -q {path} -k {name}
services:
  - name: postgres
    image: postgres:17-alpine
    env: { POSTGRES_PASSWORD: test }
    port: 5432
limits: { memory: 4g, timeout: 15m }
```

## How it works

1.  ### Write targeted tests

    MergeHarbor writes tests for the review's findings and for edge cases of the functions the pull request changed.

2.  ### Run them in a sandbox

    Each run gets a fresh sandbox with strict limits and no secrets, which is removed afterwards.

3.  ### Report what happened

    Proven findings get the failing test, the command and its output as a reply. Tests that were wrong or flaky are discarded and never posted.

## What you get

Evidence on the finding

A proven finding's confidence goes up, and the reply shows the test and its output. Browser tests also attach screenshots and traces.

Keep the tests that pass

Add any test that passed or proved a finding with one click. MergeHarbor opens a small pull request into your branch and never pushes to it directly.

Run on request

Comment @mergeharbor test on a pull request, or select Run tests in the console. Or run them after every review in scope.

Common stacks detected

Go, Node.js, Python, Java, Kotlin, Ruby, Rust and .NET projects are detected. Add .mergeharbor/sandbox.yml when your project needs more.

A locked-down sandbox

No credentials, no network except package registries during install, and output scanned for secrets and redacted before it is stored or shown.

Counts in the merge gate

A finding a test reproduced counts as proven in the merge gate, and generated tests that passed raise merge readiness.

Documentation: [Proof runs](https://mergeharbor.com/docs/proof-runs) [Test gaps and coverage](https://mergeharbor.com/docs/test-gaps)

## Frequently asked questions

What does a proof run cost?

Each run that uses the sandbox costs 2 credits in addition to the review. Proof runs are off by default and included in the Team, Advanced and Enterprise plans.

Can a pull request change how its own tests run?

No. sandbox.yml is read from the branch the pull request targets, so changes to it apply once they merge.

Can I limit when proof runs happen?

Yes. Under Settings → Checks & gates → Proof runs, limit them to some target branches or paths, skip drafts, and set tests per run and runs per month. Each repository can override these.

Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support)

## Explore other features

### Merge gate

One safe-to-merge verdict with a checklist

[Merge gate](https://mergeharbor.com/features/merge-gate)

### Change risk

Risk scores, test gaps and migration safety

[Change risk](https://mergeharbor.com/features/change-risk)

### Codebase-aware review

Reviews that read your codebase, not just the diff

[Codebase-aware review](https://mergeharbor.com/features/review-agent)

## Review every pull request with the context of your whole codebase

Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.

[Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)