> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Review the pull request diff for malicious code, workflow changes, and risky lifecycle hooks.

# Security scanning

The **Superagent Security Scan** reviews the pull request diff on every open and update. It looks at the code that changed, not the packages that were added. Findings land as inline review comments on the exact line, and the check run is what your branch protection rules can require.

This is one of two scans in [PR Scans](https://www.superagent.sh/docs/security-workers/pr-security). The other is [Supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security/supply-chain-scanning), which scores added or upgraded dependencies when a lockfile or manifest changes.

### How it works

When a pull request opens or updates on a connected repository, Superagent:

1. Creates a **Superagent Security Scan** check run on the head commit.
2. Reviews the changed files in an isolated sandbox, including GitHub Actions workflow patches.
3. Posts findings that require changes as inline review comments on the exact line.
4. Completes the check. Failed or action-required results block merge when your branch protection rules require the check.

Ordinary refactors, formatting, and expected application behavior without concrete suspicious evidence are not reported.

### What it looks for

The scan focuses on three areas:

| Area | What Superagent reviews |
| --- | --- |
| **CI/CD** | GitHub Actions workflow changes: dangerous triggers, broad permissions, unpinned actions, shell injection from untrusted event data, privileged checkout of pull request heads, cache and artifact poisoning, and self-hosted runners reachable from forks |
| **Lifecycle hooks** | Code that runs during install, build, test, release, or startup — package-manager scripts, `postinstall` and similar hooks, build files, Docker entrypoints, git hooks |
| **Malicious intent** | Secret exfiltration, obfuscation, unexpected network calls, credential handling changes, dangerous `eval`/`exec`, and changes that hide behavior from reviewers |

It is not a CVE catalog or a full-repository audit. For a deeper pass over the whole codebase, see [repository red teaming](https://www.superagent.sh/docs/security-workers/red-team/repositories).

### Check results

The check completes after the sandbox review finishes. Failed or action-required conclusions prevent merge when **Superagent Security Scan** is a required check. Dismissing a GitHub review conversation does not by itself change the check; Superagent tracks dismissed findings per repository.

### From finding to fix

Inline comments include the evidence and a short recommendation. Findings that need deeper work land in the [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue, where automated triage can verify them and one click turns a confirmed finding into a ready-to-review fix PR.

### Request a review on demand

Comment `@superagent review` on a pull request to request a security scan, including when automatic security scans are deactivated. Pull request authors and repository members with write, maintain, or admin access can request a review by default.

Repository owners can add more users or bots under **Allowed review actors** in the repository settings. Enter an exact GitHub login such as `github-actions[bot]` for an automation account that does not appear in the collaborator list. Allowlisted actors can request reviews and dismiss findings by replying to inline finding comments. Superagent's own bots cannot be allowlisted.

### Enable or deactivate scanning

Security scanning is enabled by default for repositories connected to the **Superagent Security** GitHub App.

To change it:

1. Open **Repository** in Superagent.
2. Select the repository.
3. Find **Security scan** in the repository settings.
4. Turn the setting on or off.

Deactivating the setting prevents new security checks from starting for that repository. It does not remove historical GitHub checks or comments.

## Next steps

- [Understand supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security/supply-chain-scanning)
- [Review findings and reports](https://www.superagent.sh/docs/concepts/findings-and-reports)
- [Run a deeper repository Red Team assessment](https://www.superagent.sh/docs/security-workers/red-team/repositories)

---
Source: https://www.superagent.sh/docs/security-workers/pr-security/security-scanning
Index: https://www.superagent.sh/llms.txt