AI security review on every pull request
Every Solemly review includes a dedicated security review, reported separately on the Solemly / Security check, so security findings aren't lost among the rest. With blocking on, a CRITICAL or HIGH security finding fails that check, and making it required holds the merge until the finding is fixed.
Checked against the product on 2026-11-03.
What the security review looks for
It looks at the change the way an application-security engineer would, for vulnerabilities such as:
- injection: SQL, command, path and template
- broken authentication or authorization: IDOR, privilege escalation, missing checks
- secret and credential leaks
- unsafe deserialization,
evalorexec - SSRF and open redirects
- misuse of cryptography
- exposure of sensitive data
- missing validation of untrusted input
Like every finding, security findings are double-checked before they're posted, so what reaches the pull request is what Solemly can back up.
Where the findings appear
Security findings are posted with the rest of the review, in their own Security part of the summary, and the Solemly / Security check reports the result:
| Status | Meaning |
|---|---|
| Security scan complete | The security review ran. Any findings are in the review. |
| Blocking: N high-severity security finding(s) | A CRITICAL or HIGH security finding, with blocking turned on. |
| Security scan not run | The change had nothing security-relevant to check. |
Block merges on security findings
With Block on high severity turned on for the repository, a CRITICAL or HIGH security finding fails Solemly / Security as well as Solemly / Review. Make Solemly / Security a required check to gate merges on security findings alone. See Block a merge on AI code review findings.
What it doesn't replace
An AI security review helps catch problems early, on every pull request, but it doesn't replace your other security testing, such as static analysis, dependency scanning or penetration tests.
Questions
Does every review include the security review?
Yes. It runs as part of every review and is reported on its own Solemly / Security check. When a change has nothing security-relevant to check, the check reads Security scan not run.
Can I block merges only on security findings?
Yes. Turn on Block on high severity for the repository and make Solemly / Security a required check, without requiring Solemly / Review.
Are security findings separate from the rest of the review?
They're posted with the rest of the review, in their own Security part of the summary, and reported on the Solemly / Security check rather than Solemly / Review.
Is this a replacement for static analysis or a penetration test?
No. It catches problems early on every pull request, but it doesn't replace your other security testing.
In the docs
Related
Try it on your next pull request
Free for 14 days with every feature, no credit card. Install it on a repository and the next pull request gets reviewed.