Skip to main content

How it works

PR Review runs in the background on a Project. The flow is:

  1. A pull request opens or updates on the connected GitHub or GitLab repository.
  2. AISafe detects the pull request, identifies the project, and creates a PR review.
  3. The AI agent fetches the diff, extracts the changed files, and runs a focused security analysis on those paths, leveraging the project's living knowledge base for context.
  4. The agent posts a review on the PR with inline comments on specific lines, including severity ratings and suggested fixes.

Why it is not an assessment​

PR review is a project-level continuous capability, not an Assessment. It produces inline PR comments rather than a findings report. This keeps the feedback loop tight: developers get security feedback in their existing code review workflow without switching tools.

Delivery log​

Each VCS-backed project includes a delivery log on its Source tab. Use it to diagnose why a push or pull request did not trigger a review or source sync. Delivery rows show the repository, commit, event type, status, and a readable ignored reason such as an unbound project, branch filter mismatch, or disabled PR review.

Knowledge base​

The project owns a living knowledge base that accumulates context across scans. PR review loads this context to understand the changed paths. See Concepts: Project for how the knowledge base works.