Recommendations

Last updated 2 October 2026.

What does MergeSafe check in my repository settings?

For each repository, MergeSafe reads seven GitHub security and hygiene settings, shows which are in place, and gives the steps to turn on the rest; it only reads them and never changes your repositories.

The seven checks

1. Dependabot alerts: GitHub tells you when a dependency you use has a known vulnerability.
2. Dependabot security updates and dependabot.yml: Dependabot opens pull requests that fix vulnerable dependencies and keeps them up to date on a schedule.
3. Secret scanning and push protection: catches API keys and tokens committed to the repository, and blocks pushes that contain them.
4. The default branch requires a review and the MergeSafe check: nothing reaches the default branch without an approving review and a passing mergesafe-review check.
5. A CODEOWNERS file: pull requests automatically ask the right people to review the code they own.
6. Code scanning (CodeQL): GitHub analyses every push and pull request for security bugs in your own code.
7. Workflow secrets are defined: a workflow that uses a secret nobody defined fails, or runs with an empty value.

What you get for each

• A status: On, Off or Can’t tell, and a score such as “5 of 7 in place”.
• For each one that is off: why it matters, the steps, a link to the setting on GitHub, and a prompt to paste into your AI coding agent to make the change. Prompts name secrets, never their values.
• If MergeSafe lacks read access to a setting, an Approve read access link to your GitHub installation settings.
• Results are kept for 6 hours; Refresh checks again.

Find them on the Repositories page in the app. Secret scanning and CodeQL on a private repository need GitHub’s paid add-on. MergeSafe itself doesn’t check dependencies for known vulnerabilities; see what we do not check.

Next: Sentry integration →