PR Scans
Vulnerability checks on every pull request, with findings on the exact line and fixes as pull requests.
Every pull request on a connected repository gets checked before it merges. The Superagent Security GitHub App reviews the diff and publishes its verdicts as GitHub check runs and inline review comments on the exact line, so your CI stays the source of truth. Free for open source: unlimited scans on public repos.
The checks
Three checks run on pull requests, all published by the Superagent Security app:
| Check | Runs when | What it does |
|---|---|---|
| Security scan | PR open and update | Reviews code changes for vulnerabilities and posts inline findings |
| Superagent Supply Chain Scan | A supported dependency file changes | Flags risky added or upgraded dependencies. See Supply chain scanning |
| Contributor trust | PR open and update | Scores the risk of who is behind the code. See Contributor Trust |
A fourth check, Contributor License Agreement, comes from the Open CLA app and is covered under Agreements.
Where results appear
On GitHub, findings sit as inline review comments on the exact line, with the context your reviewer needs. Each check completes as a GitHub check run, and failed or action-required checks block merge when your branch protection rules require them.
In the dashboard, the repository detail page (/app/repository/[repositoryId]) lists recent pull request checks for the repo, next to the per-repo scan settings.
Configure scans per repo
Scan behavior is set per repository, not globally. Open a repository from Repository to:
- Turn Security scan, Supply Chain Scan, and Contributor trust on or off
- Review recent scans and finding dismissals
Supply chain scanning is enabled by default on connected repositories.
From finding to fix
Findings that need deeper work land in the Findings queue, where automated triage verifies them and one click turns a confirmed finding into a ready-to-review fix PR.