App details
Subscribed webhook events
BattleTest subscribes to the following events. Each maps to behaviour in the webhook handler; if an event is not enabled in the App’s subscription settings, the corresponding behaviour will silently not fire.Permissions
BattleTest does not request push access, admin access, or access to Actions secrets.
Data handling
BattleTest reads repository code at review time for analysis. Source code is not persistently stored. Finding metadata (file paths, line numbers, vulnerability descriptions) is stored. See Security & Data Handling for full details.Status check behaviour
The check conclusion mirrors the review verdict, so it can act as an opt-in merge gate.
By default nothing blocks a merge —
action_required simply surfaces a “needs attention” state on risky PRs. A single LOW finding or likely false positive (risk below 40) passes as success. To turn the review into a hard gate, add it as a required status check in GitHub branch protection — then PRs whose risk warrants changes are blocked until resolved. See How to require security review before merging and Risk score.