# Security checks on every pull request, at no cost

Before a model reads the change, built-in rules look for committed secrets, injection risks, unsafe settings and risky migrations. These checks use no model and no credits.

[Start free trial](https://app.mergeharbor.com/signup) [Read the docs](https://mergeharbor.com/docs/migration-and-api-safety)

mergeharbor bot An illustrative early finding

config/settings.py:18 · critical · security

Deterministic check: committed secret

A cloud access key is committed in source. Anyone who can read the repository can use it, and it stays in git history.

Revoke the key, then load it from your secret manager.

Posted early. The full review is on its way.

## How it works

1.  ### Read the change

    When a pull request opens or updates, MergeHarbor runs its deterministic checks first, before the model review starts.

2.  ### Apply built-in rules

    The rules catch defects that need no judgment, such as committed secrets, SQL and shell commands built from values, and disabled TLS checks.

3.  ### Post what matters early

    Problems the checks catch, such as a committed secret, are posted seconds after MergeHarbor reads the change, while the model is still reviewing.

## What you get

Secrets and injection

Committed secrets, SQL and shell injection, XSS sinks and eval are flagged on every pull request.

Unsafe settings and code

Disabled TLS verification, unsafe deserialization, debugger statements, missing awaits, conflict markers, and large binaries or data dumps.

Migrations that lock or lose data

Rules flag blocking index builds, dropped columns, in-place type changes and unbounded deletes, and explain the safer way for your framework.

Breaking API changes

Edits to OpenAPI, protobuf and GraphQL contracts are compared with the base version, and every change that breaks an existing client is listed.

Quiet when nothing is wrong

The checks are measured on clean code so they stay quiet when nothing is wrong. Any rule can be turned off for an organization, repository or folder.

Secrets never reach a model

API keys, tokens, private keys and passwords in connection strings are removed before content reaches a model, logs or archives.

Documentation: [Migration and API safety](https://mergeharbor.com/docs/migration-and-api-safety) [Pull requests in the console](https://mergeharbor.com/docs/pull-requests)

## Frequently asked questions

Do the security checks use credits?

No. They run without a model. Reviews where only the free deterministic checks ran use no credits.

Can I turn off a rule that does not fit my codebase?

Yes. List it under review.checks.disable in .mergeharbor.yml, or in a folder's .mergeharbor/config.yml to turn it off only for that folder.

Is this a replacement for the model review?

No. The checks run first and catch what needs no judgment. The model review then investigates the change with codebase context. With evidence-based scoring on, a matching check counts toward a finding's confidence.

Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support)

## Explore other features

### Codebase-aware review

Reviews that read your codebase, not just the diff

[Codebase-aware review](https://mergeharbor.com/features/review-agent)

### Change risk

Risk scores, test gaps and migration safety

[Change risk](https://mergeharbor.com/features/change-risk)

### Merge gate

One safe-to-merge verdict with a checklist

[Merge gate](https://mergeharbor.com/features/merge-gate)

## Review every pull request with the context of your whole codebase

Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.

[Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)