Code changes
Check for missing access controls, unsafe input handling and security issues that span related files.
Example: an invoice query without an account check.FREE HOSTED PR REVIEW / GITHUB
Security findings
in your pull requests.
Review code changes for security issues, exposed secrets and vulnerable dependencies. Get findings beside the affected code, before your team merges.
Free hosted review · Public and private repositories · Usage limits apply
Watch the walkthrough 1:17wonderland / billingExample repository
Add invoice lookup endpoint #142
OpenAlex wants to merge 1 commit into
mainsrc/routes/invoices.ts+4 −018
router.get("/invoices/:id", requireAuth,19
async (req, res) => {20+
const invoice = await db.invoice.findUnique({21+
where: { id: req.params.id }22+
});23
if (!invoice) return res.sendStatus(404);24+
return res.json(invoice);25
}26
);Alex adds an invoice endpoint. The request is authenticated, but the lookup only checks the invoice ID.
01 / WHAT GETS CHECKED
Code, credentials
and dependencies.
Exposed secrets
Scan changes for exposed credentials and tokens, with guidance on removing them and rotating the affected keys.
Removing a key from the diff does not revoke it.Vulnerable dependencies
Check dependencies against known vulnerabilities. Review affected packages, advisory links and available fix versions.
See which package needs an upgrade and why.02 / CONNECT YOUR REPOSITORIES
Choose the repositories.
Open a pull request.
Start with GitHub sign-in, then connect the BattleTest GitHub App to your workspace. You choose which repositories it can access.
Install BattleTest Security
on your account wonderland
All repositories
Only select repositories
Select repositories
wonderland / billing
Choose which repositories the App can read and review. View permissions
CodePull requests 1Actions
Add invoice lookup endpoint #142
A
Adds an authenticated endpoint to retrieve an invoice by ID.
Add invoice endpoint
7c2a91fSome checks haven’t completed yet1 in progress
BattleTest Security ReviewReviewing the pull request
Reviews start when you open or update a pull request. Drafts are reviewed once marked ready.
Example setup
Your code and review data
Hosted review processes relevant code and pull request content. It stores review records, findings and the code excerpts needed to explain them.
Data handlingYour merge rules
A review can request changes. To make its status check block merging, add BattleTest Security Review to your required checks in GitHub.
03 / FREE USAGE
Free review
allowances.
In-depth reviews analyse code changes, secrets and dependencies. After that allowance is used, basic scans check secrets and known dependency vulnerabilities within a separate hourly limit.
20 / hour
In-depth reviews per repository
Then up to 20 basic scans per hour, per repository.
10 / month
In-depth reviews per account
Shared across your private repositories. Then up to 5 basic scans per hour.
If both allowances are exhausted, re-run the review after the limit resets. Hosted service safeguards also apply. Full limits →
USE YOUR OWN SERVICES Your model connection
Your model connection
and storage.
Connect your own model provider for in-depth reviews without BattleTest’s hourly or monthly review caps. Connect S3-compatible storage to keep finished reports in your bucket. These settings work independently; BattleTest still hosts the review service.
Set up your own services- No BattleTest fee for either connection
- You pay your model and storage providers
- Configure once for the organisation
START WITH ONE REPOSITORY
Add security review
to your pull requests.
Connect GitHub, select a repository and open a pull request.
Get started with GitHubMaintain an open-source project? Apply for sponsored reviews
Need self-hosted code review and live application testing? Explore Enterprise
The review will appear beside the affected code.