CodeRabbit Secure adds multi-repository analysis to Deep Scan

Security risks can cross repository boundaries

CodeRabbit's announcement focuses on security gaps that cannot be assessed by examining a single repository. In a microservices application, for example, an API gateway may verify a user's token and pass the user's ID to an orders service, while the orders service returns orders based on an incoming x-user-id header.

If the orders service can be reached directly, a caller could send another person's ID. Determining whether that risk is real requires examining the gateway, the orders service and the network configuration connecting them. CodeRabbit says multi-repository analysis is intended to provide that broader context during a Deep Scan.

How Deep Scan selects and uses related repositories

Before a scan begins, CodeRabbit uses architecture summaries and its auto-linking capability to identify repositories that may provide useful context. The company says this can help an agent find a shared library, deployment chart or other closely related source without bringing every repository in an organization into the investigation.

Teams can configure repository links and source access. During a scan, agents can follow a configuration value to the code that reads it, inspect a shared implementation or examine deployment settings that affect a finding. Making a repository available does not mean every file will be inspected or cited.

The primary repository receives the Deep Scan's assessment. Linked repositories provide read-only context and do not receive their own findings or coverage from that scan. Users must run a separate scan to assess a linked repository itself. CodeRabbit says linked source is pinned to a commit on the linked repository's default branch, which may differ from the version deployed in a particular environment.

Infrastructure code can change the meaning of a finding

CodeRabbit says it prioritizes infrastructure-as-code repositories because service code alone may not show whether an endpoint is reachable outside a cluster. Load balancers, ingress settings and deployment configuration can determine how traffic reaches an application, while source code shows how the application responds. The company cautions that neither configuration files nor source code alone proves which revision or settings are running in a specific environment.

Deep Scan's security agent works through three phases: Recon, Hunt and Verify. Linked source gives the agent somewhere to investigate when evidence lies outside the primary repository. During Recon, it can connect a configuration value with an implementation. During Hunt and Verify, it can examine whether that value reaches a sensitive code path or whether another component changes the conditions behind a candidate finding.

Tests connected credentials and settings to runtime behavior

CodeRabbit tested the feature on open-source projects that separate deployment charts, container images and application code. In one experiment, a chart snapshot contained default administrator credentials. The related container's startup code showed that the values were passed to the application's installation command during a fresh installation, giving the finding a more precise condition.

According to CodeRabbit, repeated scans using automatic linking applied this bootstrap evidence fully, while scans without linked context were partial on that question. A separate runtime check found that changing the bootstrap-password environment value did not rotate the password of an existing installation. That prevented the company from treating a changed startup value as equivalent to changing an already-created account's password.

A second experiment examined whether a caller could invoke a reload endpoint under different configurations. The agent followed chart values into deployment flags and then inspected the route and handler in the runtime source. In repeated tests where the runtime repository was supplied manually, the evaluator distinguished enabled and disabled configurations. With only the chart, both answers remained unresolved.

Deep Scan can use linked repositories on GitHub Cloud, GitHub Enterprise Server and GitLab Cloud. In manual mode, it reads only repositories selected for source access. In automatic mode, eligible linked repositories, including newly discovered ones, are readable up to the plan limit until the source list is customized. Findings remain tied to the primary repository, while cited linked sources can provide the repository, file and pinned commit as supporting evidence.