// pr scans
Security scanning
Review pull request diffs for suspicious or malicious changes, with inline findings and a dedicated GitHub check.
The Superagent Security Scan reviews the pull request diff on every open and update. It looks at the code that changed, not the packages that were added. Findings land as inline review comments on the exact line, and the check run is what your branch protection rules can require.
This is one of two scans in PR Scans. The other is Supply chain scanning, which scores added or upgraded dependencies when a lockfile or manifest changes.
How it works
When a pull request opens or updates on a connected repository, Superagent:
- Creates a Superagent Security Scan check run on the head commit.
- Reviews the changed files in an isolated sandbox, including GitHub Actions workflow patches.
- Posts actionable findings as inline review comments on the exact line.
- Completes the check. Failed or action-required results block merge when your branch protection rules require the check.
Ordinary refactors, formatting, and expected application behavior without concrete suspicious evidence are not reported.
What it looks for
The scan focuses on three areas:
| Area | What Superagent reviews |
|---|---|
| CI/CD | GitHub Actions workflow changes: dangerous triggers, broad permissions, unpinned actions, shell injection from untrusted event data, privileged checkout of pull request heads, cache and artifact poisoning, and self-hosted runners reachable from forks |
| Lifecycle hooks | Code that runs during install, build, test, release, or startup — package-manager scripts, postinstall and similar hooks, build files, Docker entrypoints, git hooks |
| Malicious intent | Secret exfiltration, obfuscation, unexpected network calls, credential handling changes, dangerous eval/exec, and changes that hide behavior from reviewers |
It is not a CVE catalog or a full-repository audit. For a deeper pass over the whole codebase, see repository red teaming.
Check results
The check completes after the sandbox review finishes. Failed or action-required conclusions prevent merge when Superagent Security Scan is a required check. Dismissing a GitHub review conversation does not by itself change the check; Superagent tracks dismissed findings per repository.
From finding to fix
Inline comments include the evidence and a short recommendation. Findings that need deeper work land in the Findings queue, where automated triage can verify them and one click turns a confirmed finding into a ready-to-review fix PR.
Enable or deactivate scanning
Security scanning is enabled by default for repositories connected to the Superagent Security GitHub App.
To change it:
- Open Repository in Superagent.
- Select the repository.
- Find Security scan in the repository settings.
- Turn the setting on or off.
Deactivating the setting prevents new security checks from starting for that repository. It does not remove historical GitHub checks or comments.