PR Security brings four security workers into pull request review. Each worker answers a different question before merge.

Four workers, four decisions

Security worker	Pull request question	GitHub check
Security scanning	Does the diff introduce vulnerable or malicious code?	Superagent Security Scan
Supply chain scanning	Are added or upgraded packages safe?	Superagent Supply Chain Scan
Contributor Trust	Does the contributor's identity and history indicate risk?	Contributor trust
Contributor Agreements	Has every contributor signed the required agreement?	Contributor License Agreement

The checks run independently and can be required through branch protection. Security scanning and supply chain scanning are enabled by default on connected repositories. Contributor Trust is enabled by default for public repositories and disabled by default for private repositories. Contributor Agreements runs after you install Open CLA from Integrations and assign an agreement to the repository.

Set up PR Security

Install the Superagent Security GitHub App through Connect GitHub for security scanning, supply chain scanning, and Contributor Trust. Install Open CLA separately for Contributor Agreements. Configure each worker from the repository page in the Superagent dashboard.

Where results appear

On GitHub, every worker completes as its own check run. Security and supply chain findings also appear as inline review comments on the relevant line. Failed or action-required checks block merge when branch protection requires them.

In the dashboard, the repository detail page (/app/repository/[repositoryId]) lists recent pull request checks for the repo, next to the per-repo scan settings.

From finding to fix

Findings that need deeper work land in the Findings queue, where automated triage verifies them and one click turns a confirmed finding into a ready-to-review fix PR.

Structured agent reports

Route qualifying findings to a customer coding agent. The agent can remediate the branch and return a structured agent report through Superagent MCP. Superagent retains the report as context for later repository and supply-chain work.

Repositories can also use Secure Dependency Updates to generate package update pull requests on a schedule.