CodeRabbit Secure now traces vulnerabilities across linked repos and blocks risky merges

Deep Scan reads across repository boundaries

CodeRabbit launched CodeRabbit Secure in August to find application-specific vulnerabilities. According to the company, its agents are built for security and use semantic analysis to hunt for weaknesses the way an attacker would, then help developers fix what they find. The new release is aimed at a problem the company describes directly: attackers use AI agents to find software weaknesses faster than teams can review them.

The headline change is that Deep Scan now reads linked repositories. Production systems often span several repositories, and CodeRabbit says a scan limited to one of them can miss where a request originated or which safeguards apply. That can make protected code look vulnerable or hide a real attack path. With linked context, Deep Scan traces requests across services and libraries and accounts for safeguards elsewhere in the application before it publishes a finding. CodeRabbit says this cuts noise, and that it is especially useful for teams running microservices or shared libraries.

If CodeRabbit has already discovered related repositories during code review, Deep Scan uses the same links. Users can also link repositories by hand and add a note on how they relate. Users choose which linked repositories a scan may read. The selected repository stays the target, while the others only supply context and are not scanned themselves.

Linked repository context is available for Deep Scan on GitHub Cloud, GitHub Enterprise Server, and GitLab Cloud. A scan can read up to 20 linked repositories, subject to plan limits.

Runtime verification, delta scans and spend controls

Every Deep Scan finding already goes through a verification agent before publication. According to CodeRabbit, the verifier reopens the cited code, checks reachability, looks for safeguards elsewhere and rejects anything the evidence does not support. Runtime verification adds another layer: for eligible findings, CodeRabbit replays the exploit attempt in a throwaway sandbox, never against production systems. Users get steps to reproduce the finding and evidence from the run showing whether it holds up. It is available today for Deep Scan findings.

Delta scans are meant to keep coverage current at lower cost. A full Deep Scan reads the whole repository and sets a baseline. Delta scans then rescan only files that were added or changed, plus the parts of the Attack Surface Map that those changes made stale. Untouched code keeps its verified status. Teams can set a verified-coverage target, and CodeRabbit runs a delta scan whenever coverage dips below it, within the monthly spending cap. The company says users pay only for the work that matters, at a fraction of the cost of a full scan.

• Findings can be rechecked against the current tip of the default branch.
• Severity can be adjusted and, optionally, saved as a learning for future scans.
• When a fix merges, CodeRabbit verifies it and resolves the finding automatically.
• A spending limit stops a scan when the budget is reached, and the scan can later be resumed from where it stopped.

Merge blocking through Security Check

Repository admins can now block merges when a pull request has open critical security findings. The feature runs as a native GitHub check. To enable it, users go to Security, then Repositories, select a repository, open Settings and turn on Publish CodeRabbit Security check.

By default the check fails if a visible Security review comment is rated Critical, though a different severity threshold can be chosen. A failed check only blocks merging if an administrator adds CodeRabbit Security as a required check in a branch protection rule or ruleset.

The check report shows comment counts by severity, verified fixes and remaining blockers, each linked to its comment. Marking a GitHub thread as resolved does not clear a blocker. It persists across pushes until CodeRabbit verifies the fix. Security Check works on GitHub today, and CodeRabbit says other platforms are on its roadmap. The release also adds integrations that carry findings into ticketing systems teams already use.

What it means for teams

For teams with microservices or shared libraries, the cross-repository context is meant to reduce false alarms and surface attack paths that a single-repo scan would miss. Runtime verification gives security engineers reproduction steps and evidence, so triage can focus on findings that hold up. Spending limits, resumable scans and delta scans give security and engineering leads more control over cost. CodeRabbit also states that none of this replaces the static checks already in a team's stack, and that Secure works alongside them to answer questions fixed rules cannot, such as whether an authenticated user actually owns the data they request.