Skip to main content

​
About

Security review has Sazabi scan the code in your project’s connected repositories for vulnerabilities. When Sazabi confirms a finding, it files an issue that describes the vulnerability and the affected code, so it reaches your issue inbox like any other Sazabi issue. Security review is on by default for every project. There is nothing to set up: the repositories it covers are the ones listed under Git repositories in Settings > Code. To change what is scanned, add or remove repositories there.

​
What to expect

  • Findings arrive gradually. Sazabi files findings over time rather than all at once, so you may see several new security issues over a few days.
  • Each finding is a normal issue. It has a name, a description, a severity, an optional component, and the usual lifecycle. You can investigate, resolve, ignore, mute, or reject it the same way as any other issue. The issue history shows it as created by Sazabi, not by a person on your team.
  • No duplicates. A finding Sazabi has already filed for the project is not filed again.
  • Fix it from the issue. Investigate the finding from its thread or hand it off to your coding agent, as with any other issue.

​
Notifications

Security findings follow your project’s delivery rules, exactly like runtime issues. If a rule sends every high and critical issue to an on-call channel or paging service, a high-severity security finding goes there too. Review your rules before findings arrive if that is not what you want. See Route notifications.

​
Billing

Scanning is not billed. Each finding Sazabi files is an issue, and it counts toward issue usage the same way as any other issue on your plan. If a finding is wrong, you can reject it within 24 hours of its creation, subject to your plan’s remaining rejection allowance, to exclude it from billable issue usage.

​
Turn off security review

An organization owner or admin can turn security review off for a project. In Settings > Code, under Security review, switch off Automatic security review. The setting applies to the project you have selected, so repeat it for each project you want to exclude. When security review is off, Sazabi stops filing new security findings for that project. Issues it already filed stay in your inbox; resolve, ignore, or reject them as usual. Turn the switch back on at any time. You can also change it from the CLI with sazabi projects code-review --security-review false, through the API (projects.codeReviewSettings.update) or with the sazabi_project_code_review Terraform resource.

​
Further reading

Issues

How issues work: lifecycle, severity, and responding.

Route notifications

Decide which issues reach which channels.

Billing

Issue usage, rejection, and your invoice.