> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security review

> How Sazabi scans your connected repositories for vulnerabilities and files confirmed findings as issues, and how to turn it off for a project.

## About

Security review has Sazabi scan the code in your project's connected repositories for vulnerabilities. When Sazabi confirms a finding, it files an [issue](https://docs.sazabi.com/guides/detect/issues.md) that describes the vulnerability and the affected code, so it reaches your issue inbox like any other Sazabi issue.

Security review is on by default for every project. There is nothing to set up: the repositories it covers are the ones listed under **Git repositories** in [**Settings > Code**](https://app.sazabi.com/settings/code-search). To change what is scanned, add or remove repositories there.

## What to expect

* **Findings arrive gradually.** Sazabi files findings over time rather than all at once, so you may see several new security issues over a few days.
* **Each finding is a normal issue.** It has a name, a description, a severity, an optional component, and the usual lifecycle. You can investigate, resolve, ignore, mute, or reject it the same way as any other issue. The issue history shows it as created by Sazabi, not by a person on your team.
* **No duplicates.** A finding Sazabi has already filed for the project is not filed again.
* **Fix it from the issue.** Investigate the finding from its thread or hand it off to your coding agent, as with any other issue.

## Notifications

Security findings follow your project's delivery rules, exactly like runtime issues. If a rule sends every **high** and **critical** issue to an on-call channel or paging service, a high-severity security finding goes there too. Review your rules before findings arrive if that is not what you want. See [Route notifications](https://docs.sazabi.com/guides/detect/notifications.md).

## Billing

Scanning is not billed. Each finding Sazabi files is an issue, and it counts toward issue usage the same way as any other issue on your plan. If a finding is wrong, you can [reject it](https://docs.sazabi.com/guides/administer/billing.md#issue-rejection) within 24 hours of its creation, subject to your plan's remaining rejection allowance, to exclude it from billable issue usage.

## Turn off security review

An organization owner or admin can turn security review off for a project. In [**Settings > Code**](https://app.sazabi.com/settings/code-search), under **Security review**, switch off **Automatic security review**. The setting applies to the project you have selected, so repeat it for each project you want to exclude.

When security review is off, Sazabi stops filing new security findings for that project. Issues it already filed stay in your inbox; resolve, ignore, or reject them as usual. Turn the switch back on at any time.

You can also change it from the CLI with `sazabi projects code-review --security-review false`, through the API (`projects.codeReviewSettings.update`) or with the `sazabi_project_code_review` Terraform resource.

## Further reading

> [card] [Issues](https://docs.sazabi.com/guides/detect/issues.md)
>
> How issues work: lifecycle, severity, and responding.

> [card] [Route notifications](https://docs.sazabi.com/guides/detect/notifications.md)
>
> Decide which issues reach which channels.

> [card] [Billing](https://docs.sazabi.com/guides/administer/billing.md)
>
> Issue usage, rejection, and your invoice.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.