Solemly
DocsCode Review

Security Review

The dedicated security review and its own check.

Every review includes a dedicated security review, reported separately, so security issues aren't lost among other findings.

What it looks for#

The security review looks at the change the way an application-security engineer would, for vulnerabilities such as:

  • injection: SQL, command, path and template
  • broken authentication or authorization: IDOR, privilege escalation, missing checks
  • secret and credential leaks
  • unsafe deserialization, eval or exec
  • SSRF and open redirects
  • misuse of cryptography
  • exposure of sensitive data
  • missing validation of untrusted input Like every finding, security findings are double-checked before they're posted.

Where findings appear#

  • Security findings are posted with the rest of the review, in their own Security part of the summary.
  • The Solemly / Security check reports the result:
StatusMeaning
Security scan completeThe security review ran. Any findings are in the review.
Blocking: N high-severity security finding(s)A CRITICAL or HIGH security finding, with blocking turned on.
Security scan not runThe change had nothing security-relevant to check.

Blocking on security findings#

With Block on high severity turned on for the repository, a CRITICAL or HIGH security finding fails Solemly / Security as well as Solemly / Review. Make Solemly / Security a required check to gate merges on security findings alone. See Merge Gates.

Something missing or unclear? Tell us.