// security

Security that runs on the pull request.

Not a separate scanner you have to remember to run. Eight analyzers execute alongside the AI review on the same diff, then feed the gates that block a merge.

Built-in analyzers

SAST

Semgrep + CWE-tagged rules

Static analysis on every diff, with findings posted inline on the offending line.

Secrets

keys · tokens · credentials

Catches hardcoded API keys and credentials before they reach your default branch.

Dependencies

OSV.dev · multi-ecosystem

Flags known-vulnerable packages introduced or bumped by the pull request.

IaC

Terraform · Kubernetes

Reviews infrastructure definitions for unsafe defaults and permissive rules.

Cloud misconfig

AWS · GCP · Azure

Detects risky cloud configuration in the changed files.

Complexity

hotspot detection

Surfaces functions that have grown past the point of safe maintenance.

Duplication

copy-paste debt

Identifies duplicated logic being introduced across the codebase.

Dead code

unused paths

Points out code paths nothing reaches, so they never accrete.

How we handle your code and credentials

Zero code retention: Your source is analysed to produce the review and is not retained afterwards.
Encrypted at rest: Provider tokens and integration credentials are encrypted with authenticated encryption.
Credential validation: Connecting an integration performs a live authenticated check — a bad token can never be silently stored.
Least privilege: Org roles (owner / admin / member / viewer) plus per-repository access grants for users and teams.
MFA + session security: TOTP two-factor, argon2id password hashing, refresh-token rotation with theft detection.
Breach checking: New passwords are checked against known-breach corpora before they are accepted.
Self-hosting: Run ReviewIQ inside your own infrastructure when your policy requires it.
Audit trail: Administrative actions are recorded with actor and timestamp.

SOC 2 readiness is in progress. We describe only what the product does today — if a control matters to your procurement, ask us and you'll get a straight answer.