Skip to main content

​
Overview

Security Reviewer reviews pull requests and tracks their security findings in MindFort. Use it to review code changes during development, alongside assessments of your running application.
Security Reviewer is in beta and appears when enabled for your organization. Connecting GitHub requires an upgraded plan and permission to manage integrations. Organization owners and admins have this permission; custom roles can also receive it.

​
Enable reviews

  1. Open Settings > Integrations and connect GitHub.
  2. Grant the MindFort GitHub App access to the repositories you want reviewed.
  3. Open Security Reviewer.
  4. Find the repository in Repositories and select Enable.
  5. Confirm Enable code review.
This enables security reviews of code changes. Reviews apply to pull requests targeting any branch in that repository; you do not need a separate configuration for each branch.

​
Review results

The Reviews section shows pull request review activity and outcomes. Open a review to inspect its findings and progress, then follow the pull request link to review the code on GitHub. New configurations also post a review summary on GitHub. Read each finding’s evidence and remediation guidance before deciding how to address it. A code review covers the reviewed changes; use an assessment when you need broader testing of the application.

​
Request another review from GitHub

On an open pull request that is ready for review, post a new conversation comment containing:
The repository must have reviews enabled, and you need GitHub write, maintain, or admin access. Draft pull requests are not reviewed until they are ready. Review requests remain subject to your organization’s plan and available credits.

​
Incomplete reviews and limited coverage

Read the GitHub summary and check result before treating a review as complete. A Review incomplete message means MindFort could not finish validating one or more potential findings. Any verified findings already published still need attention. For large pull requests, the summary may identify files or changes that were not reviewed. Do not treat a review with omitted changes as coverage of the entire pull request. Omitted changes are not automatically retried on later pushes; split large changes into smaller pull requests or contact support for help getting the remaining changes reviewed.

​
Manage configurations

Use Disable to stop a configuration from initiating future reviews, and Enable to turn it back on. Use Delete configuration when you no longer need the configuration. To change which repositories MindFort can access, open the GitHub integration configuration and update the GitHub App installation permissions.

​
Troubleshooting

  • The page is missing: Confirm that Security Reviewer is enabled for your organization.
  • A repository is missing: Confirm that the connected GitHub App installation has access to it.
  • Reviews are not starting: Check that the repository configuration is enabled and the organization’s billing state permits reviews.
  • A review fails: Open its details and inspect the reported failure before retrying or contacting support.
Use Patching to generate a proposed fix for a finding, or MCP to investigate it in your own checkout.