AI code review
Turn on AI code review to find flaws in your own code, such as injection and broken authorization, with explanations, suggested patches and reachability checks.
AI code review reads your own code for injection, broken authorization, insecure crypto and similar flaws. It explains each issue and suggests a patch. It's off by default and set per repository.
AI findings are suggestions: they're labeled, they never block the gate, and they don't trigger the "new Critical or High" alert. Review them as you would a teammate's pull request.
Turn it on
- Open the repository in Code Security and go to Settings > AI code review.
- Turn on AI code review and choose:
- Sensitivity: Low (only the findings it's most sure about), Balanced, or Strict (more findings, including weaker signals, and more false positives).
- Languages to review: JavaScript / TypeScript, Python, Go, PHP.
- Max files per scan: 10 to 1,000. Full scans review the most recently changed files first.
- Check whether vulnerable dependencies are reachable (needs the Dependencies scanner).
- Save. It applies from the next scan.
On a pull request, only the changed files are reviewed.
Read an AI finding
An AI finding shows the flagged lines, the AI's explanation (switch between Short and Detailed with Explain differently), its confidence, the weakness (CWE and OWASP Top 10), and a Suggested patch.
- Apply as pull request (owners and admins) applies the patch on a new branch and opens a draft pull request. Nothing is merged until someone on your team reviews and merges it. If the code has changed and the patch no longer applies, use the prompt instead.
- Fix with your AI assistant gives a prompt to paste into the coding assistant you use in your editor or terminal.
- Rate it Helpful, Not helpful or False positive. To stop seeing a false positive, ignore it with the reason False positive.
Reachability
With reachability on, AI review looks for calls to the vulnerable code of serious dependency findings, and marks each one Reachable, Not reachable or Unknown, with the call path it followed. AI can be wrong, so check the call path before you rely on it.
How your code is handled
Files are sent to the model for the review only. They aren't stored or used for training. A short excerpt around each finding and the suggested patch are kept with the finding.
Cost
AI review is billed by the tokens it uses, per scan; Explain differently uses tokens too. See Billing and retention.
Related
Policies
Set what fails the Code Security gate on each branch, which licenses are allowed, your own secret patterns, how long findings can be ignored, and fix-by dates.
API, webhooks and CI
Gate deploys on Code Security results in Infraista Pipelines or any other CI, read scans and reports through the API, and get signed webhooks.