The most dangerous line of code you'll ship probably looks harmless on its own. The risk only becomes clear when you see how it interacts with the rest of the application. Catching it means security review has to trace those connections across the entire repository.
CodeRabbit Security does exactly that, hunting application-specific vulnerabilities across the codebase, showing the evidence behind each one, and moving supported findings into remediation without leaving the development workflow.
AI is shrinking the defender’s window #
AI is increasing both the volume of code that needs scrutiny and the speed at which attackers can investigate it. In New Relic’s 2026 State of AI Coding report, 67% of surveyed technology leaders said AI generated or significantly refactored between 51% and 75% of their organizations’ weekly code output. Veracode's Spring 2026 testing gave models 80 coding tasks spanning four languages and four vulnerability categories, with no security-specific guidance. Only 55% produced secure code, and in the other 45% the model introduced a known security flaw.
Attackers are gaining the same leverage. In November 2025, Anthropic reported that a group it assessed with high confidence to be Chinese state-sponsored manipulated Claude Code into attempting to infiltrate roughly 30 organizations in a cyberespionage campaign. According to Anthropic, AI performed 80% to 90% of the campaign’s work, while human operators intervened at perhaps four to six critical decision points per hacking campaign.
Coding agents have become part of the attack surface as well. In June 2026, Tenet Security described an attack it calls agentjacking, in which instructions hidden inside fake Sentry error reports caused coding agents to perform attacker-directed actions. Tenet reported that more than 100 agents acted on injected errors during controlled validation, including Claude Code, Cursor, and Codex, with an 85% exploitation success rate against the injected errors.
We recently explored the broader threat shift in “You can’t fix what you can’t detect and understand.”
The vulnerability can be the check that never happens #
Static analysis is highly effective when a vulnerability can be identified through a known rule or data-flow pattern. It can catch hardcoded secrets, vulnerable dependencies, and many common injection paths. Other vulnerabilities depend on application-specific behavior. The relevant code may span routes, services, authorization logic, and data models, with no single line appearing unsafe on its own.
Consider this simplified request path:
A scanner focused on known rules and data-flow patterns may see several reassuring signals here. The route requires authentication, the database query is parameterized, and user input never reaches an obvious injection sink.
But the vulnerability lies in the check the application never performs.
requireAuth
proves the caller is logged in. Nothing along the request path establishes that the caller owns order :id
or has permission to view it, so any authenticated user able to enumerate order identifiers can retrieve another customer's order.
Detecting this insecure direct object reference requires application-level reasoning. CodeRabbit Security distinguishes authentication from authorization, examines the schema and surrounding code for ownership relationships, and traces req.params.id
from the attacker-controlled entry point through the controller to the database lookup. When the request path contains no ownership or authorization check, CodeRabbit Security establishes whether the route is reachable and presents the entry-to-sink evidence supporting the finding. By following the full path, it surfaces authorization-bypass chains, business-logic flaws, and prompt-injection paths that are only exploitable because of how the application is designed. Finding them means working the codebase the way an attacker would, testing hypotheses, and keeping only what the code supports.
Inside CodeRabbit Security’s four-stage workflow #
The end-to-end experience follows four connected stages: Map, Hunt, and Verify cover the analysis, and Fix begins once a finding survives verification. Each stage hands the next one the application context and supporting code it needs to take the investigation further.
Map
AI agents explore the repository inside a secure sandbox and build a system-level map of the application. They identify entry points, trust boundaries, authentication and authorization checks, and the relationships between them.
They also build a reachability graph connecting externally accessible inputs to the code and resources they can affect. This focuses the investigation on attack paths that fit the application’s architecture.
Hunt
The map narrows the field. Specialized agents investigate different risk areas in parallel, including authorization, injection, business logic, data exposure, and AI-specific threats.
They trace attacker-controlled input from entry point to sink, examine the trust boundaries and controls along the way, and gather supporting code for each candidate vulnerability.
Verify
Before CodeRabbit publishes a finding, it has to hold up under independent verification.
The verifier reopens the cited paths and checks whether the code is reachable, whether safeguards exist elsewhere in the application, whether the conditions required for exploitation can occur, and whether the evidence supports the claimed impact.
Duplicates are removed. Candidates are also rejected when they depend on test-only or unreachable code, overlook existing protections, or rest on unsupported assumptions. And when the evidence doesn't support a conclusion either way, CodeRabbit says so rather than treating incomplete analysis as proof that a vulnerability is exploitable or that the repository is secure.
Fix
For eligible findings, Fix with AI uses the confirmed attack path and application context to draft a scoped remediation on a security branch and open a reviewable pull request or merge request. The PR preserves the technical account behind the finding, from entry point and sink through the reachability analysis, exploitation conditions, and potential impact. Developers inspect the patch, review the reasoning, and run their existing tests and checks before deciding whether to merge. The finding, its evidence, the proposed fix, and the review history stay together in the development workflow instead of scattering across a scanner dashboard, a ticketing system, and a separate remediation project.
Teams can also add repository context, create Security Learnings, and write custom path instructions. CodeRabbit applies relevant guidance during subsequent AI Deep Scans, helping the analysis reflect the application's architecture and the team's documented decisions without treating that guidance as evidence by itself.
Security results are organized across dedicated views for AI Deep Scan findings, PR Findings, dependencies, secrets, software bills of materials, and attack-surface information. Supported results can be shared or exported in formats including CSV, JSON, SARIF, PDF, CycloneDX, and SPDX, depending on the result type.
Continuous coverage across every PR and the full codebase #
An application's security posture shifts with every merge, including in code that didn't change. CodeRabbit Security watches it from two complementary scopes.
AI Deep Scan analyzes committed source code and infrastructure configuration across an entire repository. Teams can run it on demand across supported providers or on a recurring schedule for GitHub repositories. It surfaces risks in code that shipped months or years ago, giving the application a security baseline.
PR Findings capture security issues raised during pull request reviews, while the intent behind the proposed change is still fresh. These findings are presented separately from AI Deep Scan results so teams can distinguish between risks in an incoming change and vulnerabilities found across committed code.
Together, AI Deep Scan and PR Findings give teams a view of security before and after merge, while keeping the two types of analysis distinct.
How CodeRabbit Security fits into Agentic Change Management #
CodeRabbit started as an independent AI review layer for pull requests. CodeRabbit Security carries that approach beyond the pull request as part of Agentic Change Management, a broader system for governing software change before and after merge.
AI review independently checks each proposed change before merge. CodeRabbit Triage helps teams prioritize and route incoming work. Change Stack explains what a change means, how it affects the architecture, and how far its impact reaches. Security carries application context beyond merge and turns verified risks back into pull requests.
The result is one control layer for evaluating proposed changes and maintaining the code that ships.
See it on your own code #
CodeRabbit Security is built on the same security and privacy foundation as CodeRabbit, with encryption in transit and at rest and independently audited SOC 2 Type II controls. The CodeRabbit Trust Center contains current information about data handling, retention, and compliance.
CodeRabbit Security is available now for GitHub Cloud and GitHub Enterprise Server, GitLab Cloud and self-hosted GitLab, Azure DevOps Services, and Bitbucket Cloud. Teams can open Security in the CodeRabbit app or follow the Security Agent documentation to get started.
Check out CodeRabbit Security and evaluate it on your repositories now.