Security checks on every pull request, at no cost
Before a model reads the change, built-in rules look for committed secrets, injection risks, unsafe settings and risky migrations. These checks use no model and no credits.
config/settings.py:18 · critical · security
Deterministic check: committed secret
A cloud access key is committed in source. Anyone who can read the repository can use it, and it stays in git history.
Revoke the key, then load it from your secret manager.
Posted early. The full review is on its way.
How it works
Read the change
When a pull request opens or updates, MergeHarbor runs its deterministic checks first, before the model review starts.
Apply built-in rules
The rules catch defects that need no judgment, such as committed secrets, SQL and shell commands built from values, and disabled TLS checks.
Post what matters early
Problems the checks catch, such as a committed secret, are posted seconds after MergeHarbor reads the change, while the model is still reviewing.
What you get
- Secrets and injection
- Committed secrets, SQL and shell injection, XSS sinks and eval are flagged on every pull request.
- Unsafe settings and code
- Disabled TLS verification, unsafe deserialization, debugger statements, missing awaits, conflict markers, and large binaries or data dumps.
- Migrations that lock or lose data
- Rules flag blocking index builds, dropped columns, in-place type changes and unbounded deletes, and explain the safer way for your framework.
- Breaking API changes
- Edits to OpenAPI, protobuf and GraphQL contracts are compared with the base version, and every change that breaks an existing client is listed.
- Quiet when nothing is wrong
- The checks are measured on clean code so they stay quiet when nothing is wrong. Any rule can be turned off for an organization, repository or folder.
- Secrets never reach a model
- API keys, tokens, private keys and passwords in connection strings are removed before content reaches a model, logs or archives.
Frequently asked questions
Do the security checks use credits?
No. They run without a model. Reviews where only the free deterministic checks ran use no credits.
Can I turn off a rule that does not fit my codebase?
Yes. List it under review.checks.disable in .mergeharbor.yml, or in a folder's .mergeharbor/config.yml to turn it off only for that folder.
Is this a replacement for the model review?
No. The checks run first and catch what needs no judgment. The model review then investigates the change with codebase context. With evidence-based scoring on, a matching check counts toward a finding's confidence.
Have another question? Ask our support team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.