FeaturesCode Review
Security Scanning
Automated security scanning with Bearer, Semgrep, and Trivy.
GitSniff integrates multiple security scanning tools that run alongside AI analysis to catch vulnerabilities and security issues.
Available scanners
Bearer
Bearer scans for sensitive data exposure in your code:
- API keys and secrets
- Database credentials
- Personal data handling issues
- Authentication token exposure
Semgrep
Semgrep performs pattern-based code analysis:
- Common vulnerability patterns (OWASP Top 10)
- Language-specific anti-patterns
- Framework-specific security issues
- Custom rule support
Trivy
Trivy scans your project dependencies and containers:
- Known dependency vulnerabilities (CVEs)
- Outdated packages with security patches
- Container image vulnerabilities
- License compliance issues
Lint
Basic code quality and style checks that can catch common programming errors.
How scanning works
Security scans are triggered automatically during the analysis pipeline:
- The pre-analysis step determines which scanners are relevant based on the PR changes
- Relevant scanners run in parallel for speed
- Results are fed into the AI analysis step for context-aware interpretation
- Findings appear in the review alongside AI-generated feedback
This approach means the AI model can interpret scanner findings in context, reducing false positives and providing more actionable recommendations.
Scan results
Security findings are categorized by severity:
| Severity | Meaning |
|---|---|
| Critical | Immediate security risk, should be fixed before merging |
| High | Significant security concern |
| Medium | Potential security issue worth reviewing |
| Low | Minor issue or best practice suggestion |