What we check for security
Every review level includes a security review of each commit it reviews, in any language. This page lists what it covers. Each review’s summary says which security review ran on that commit and what it found.
Compliance: a SOC 2 Type II audit has not yet started. MergeSafe is not SOC 2 certified. How long we keep code-derived data, and who processes it, is on Security and data retention.
What every level covers
- Injection: SQL, command and template
- Access control and insecure direct object references (IDOR)
- Secrets and credentials in code
- Server-side request forgery (SSRF)
- Path traversal
- Unsafe deserialization
- Cryptography misuse
- Open redirects
- Cross-site scripting (XSS)
- Changes to protective controls: redaction, allow and deny lists, guards
- Go- and Ruby-specific risks
Levels
- Budget and Strong. Standard security review, on every commit reviewed.
- Expert security add-on (included in Ultra). A deeper, slower security review.
What we do not check
- Dependency vulnerabilities (CVEs). No lockfile or manifest is matched against a vulnerability database, on the diff or on the whole repository. Use Dependabot, OSV-Scanner or similar.
- Running code (DAST). No dynamic scanning, fuzzing or penetration testing. Short Python, JavaScript or TypeScript probes may run in an isolated sandbox to prove logic bugs, never to test security.
- The whole repository. Every check reviews what the pull request changes. The agents read other files to trace a path, but pre-existing issues elsewhere are not audited.
- Infrastructure as code and cloud configuration. Terraform, Kubernetes, Dockerfiles and cloud policies get the general review only, with no dedicated infrastructure security checks.
- Secrets in git history. Only lines the pull request changes are scanned for secrets.
- Licence compliance and container images. Not checked.