Security Review

Security Review is part of Edgenivo Agent. It scans your code for security vulnerabilities and reports what it finds in the Vulnerabilities dashboard.

It helps you find issues such as code injection, authorization bypass, and credential exposure before they reach your users.

To enable Security Review, navigate to the Agent settings page.

1. In the Security Reviews section, turn on Review Deployments Automatically.
2. Under Projects to Review, choose which projects to review:
   • All projects (default)
   • Specific projects, up to 100
3. Click Save to confirm your settings.

Once you've enabled Security Review, it automatically reviews new code changes in the projects you selected, whether or not they come from a pull request.

Security Review runs automatically when code is pushed to a connected GitHub repository.

Reviews start when code is pushed, and every project from a single push event is reviewed together. Because reviews start from push events rather than pull requests, Security Review also covers direct pushes and force pushes to your production branch.

Each review compares the source against a base, so it covers what changed rather than your whole code repository:

• Deployment reviews: The base is the previous deployment of the branch, falling back to the GitHub API when no previous deployment exists.
• Pull request reviews without a deployment: The finding is tracked against the branch and pull request rather than a deployment.
• Monorepos: Reviews are scoped to each project's root directory.

When no base exists, such as a project's first review, the review reads the full source.

Security Review reports its findings to the Vulnerabilities dashboard and adds its own GitHub check to each commit it reviews. On a private or internal repository, when the commit is on a branch with an open pull request, Security Review also posts its findings as comments on that pull request, each linking to the finding.

Check out Managing Security Reviews for details on triaging findings, fixing them with Edgenivo Agent, writing security policies, and the roles and permissions required.

To triage findings from your terminal or an agent, use vercel security vulnerabilities to list, inspect, dismiss, and reopen them.

Security Review uses provider inference at the underlying token rate with no markup, plus the Edgenivo Token Rate of $0.25 per million tokens. Reviews run per Git push event rather than per pull request, so cost scales with how often you push and how much code changed.

See Edgenivo Agent pricing for complete rates and cost-tracking information.

Findings show snippets of your source code, including any confidential, personal, or sensitive data those snippets contain.

In the Vulnerabilities dashboard, the Owner, Member, Developer, and Security roles see findings for every project, a Contributor sees only the projects assigned to them, and the Billing and Viewer roles see none. When Security Review posts a finding to a private or internal repository's pull request, anyone with access to that repository can read it, which can be a wider audience than the dashboard. On a public repository, Security Review posts only its check, which names what it reviewed and links to the Vulnerabilities dashboard, so an unpatched vulnerability isn't disclosed publicly, and the findings stay in the dashboard.

Security Review analyzes your code, not your running application. It isn't a security audit, and it doesn't perform runtime or penetration testing. It helps you find vulnerabilities but doesn't guarantee your application is free of them.