AI code review for security-sensitive repositories

Last updated 11 October 2026.

Can MergeSafe review code that handles payments, logins or customer data?

Yes: every MergeSafe level includes a security review of each commit it reviews, the Expert security add-on adds a deeper one, and a P0 or P1 finding fails the mergesafe-review check so it can block the merge.

What you get

• A security review on every commit, on every level: injection, access control and IDOR, secrets, SSRF, path traversal, unsafe deserialization, cryptography misuse, open redirects, XSS, and changes to protective controls such as allow lists and redaction.
• Expert security (+$0.45, included in Ultra): a deeper, slower security review of the whole change.
• A blocking check. Make mergesafe-review a required check, and an open P0 or P1 stops the merge.
• Settings worth having. Recommendations check secret scanning, push protection, CodeQL, Dependabot and branch protection.

What happens to your code

• Most code-derived data expires 30 days after last use, all of it is encrypted with a key per repository, and is deleted on uninstall. See Security and data retention.
• Your code goes only to vetted AI model providers, listed on Subprocessors.
• We are SOC 2 ready: our controls are built for an audit. We are not certified, and we have not yet started one. See Security and compliance. A Data Processing Agreement is available on request.

Know the limits

MergeSafe reviews what a pull request changes. It doesn’t scan dependencies for CVEs, run dynamic tests, audit the whole repository or search git history for secrets. The full list is on Security checks; pair it with the tools that do.

Next: AI agent pull requests →