> ## Documentation Index > Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # PR Scanning > Catch vulnerabilities before they reach your main branch with automated pull request scanning ## How It Works ZeroPath PR scanning analyzes the code changes in your pull requests and merge requests, catching security issues before they're merged. Scans run automatically when a PR is opened or updated, and results appear directly in your VCS. Only changed files and surrounding context are analyzed — fast and targeted. Scans both target and PR branches, surfacing only *new* findings in the PR. SAST, SCA, Secrets, and IaC run simultaneously on changed code. Every finding is validated in the context of the diff to minimize false positives. ## Supported Platforms | Platform | Trigger | Check Status | Inline Comments | | -------------------------------------- | ---------------------------------------- | -------------------------- | --------------- | | **GitHub** (Cloud & Enterprise Server) | GitHub App webhook | GitHub Check Runs | Yes | | **GitLab** (Cloud & Self-hosted) | Merge Request webhook / Pipeline webhook | Commit Statuses / Pipeline | Yes | | **Bitbucket** (Cloud & Data Center) | Pull Request webhook | Build Statuses | Yes | | **Azure DevOps** | Pull Request webhook | Build Statuses | Yes | All four platforms support the full PR scanning feature set: automatic triggering, status reporting, and inline code review comments. Want to verify that your PR fixes a known vulnerability? See [Fix Verification](/scanning/fix-verification) to learn how to reference issues in your PR description. ## What Gets Analyzed PR scanning is strictly diff-focused. It does not re-scan your entire codebase on every PR. Retrieves the unified diff from your VCS API (falls back to `git diff` if needed). When the PR branch shares no common ancestor with the target branch (for example, orphan branches or force-pushed histories), ZeroPath automatically falls back to a direct tree comparison so the scan can still proceed. Maps every changed hunk to its file and line numbers. On changed files only: * **SAST** — static analysis on both target and PR branches, surfacing only new findings * **SCA** — dependency analysis when manifests/lockfiles changed (AI pre-screen skips if not relevant) * **Secrets** — scans the diff for hardcoded credentials * **IaC** — checks changed infrastructure files Only findings that overlap with changed lines are reported. New files are included entirely; deleted files are excluded. AI validation removes false positives. When a previously reported issue is re-evaluated and determined to be a false positive, it can be automatically resolved. Results are posted to your VCS as check statuses and inline comments. When a PR is updated after a previous scan was skipped (for example, because the earlier diff was not security-relevant), ZeroPath excludes the skipped scan from the refresh baseline. This ensures the incremental comparison covers the full set of PR changes rather than only the most recent update. ## Check Status & Feedback Results are reported through multiple channels: A pass/fail check status is posted on your PR. This integrates with branch protection rules so you can **require ZeroPath checks to pass** before merging. | Status | Meaning | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Success** | No security-relevant issues found (or only below threshold) | | **Failure** | Confirmed vulnerabilities found above configured threshold | | **Neutral** | Scan timed out (does not block merges by default). Timeout statuses are posted consistently across all supported VCS platforms, including for scans that time out while queued. | | **Skipped** | Infrastructure error (deliberately not a failure to avoid blocking merges). Error messages are specific to the failure type — for example, distinguishing repository access issues from transient service errors — for easier troubleshooting. | ZeroPath posts **inline comments directly on the affected diff lines** showing: * The vulnerability type and severity * A description of the issue and its impact * If auto-patching is enabled, a fix suggestion that can be applied with one click When a previously reported finding is no longer detected in a subsequent scan of the same PR, ZeroPath automatically resolves the corresponding inline comment, keeping your review thread clean and up to date. The original comment text is struck through and replaced with a **"Resolved"** banner indicating the issue was not detected in the latest scan. On platforms that support it, the review thread is also collapsed or marked as resolved. Comment threads are also resolved automatically when you mark the underlying issue as **false positive**, **resolved**, or any other closed state from the ZeroPath dashboard, API, or via a bot command. This works across GitHub, GitLab, and Bitbucket, so your PR review stays in sync with your triage decisions. Inline comments are enabled by default and can be disabled per repository. An optional summary comment listing all findings, grouped by severity. You can control summary comments separately for scans that find issues and scans that come back clean, so your team only receives the notifications that matter. When more than 10 issues are found, the summary shows the top 10 and includes a link to view all results in the ZeroPath dashboard. The summary header now displays the exact number of issues detected (e.g., "3 possible security issues detected") for quick at-a-glance triage. If the PR comment body exceeds VCS size limits, it is automatically truncated at a clean boundary and a link to the full scan results in the ZeroPath dashboard is appended so you can always access the complete findings. When a PR is merged with open vulnerabilities, ZeroPath fires notifications via your configured channels (Slack, webhooks, etc.) alerting the team. The notification includes all confirmed and unresolved findings from the PR, including findings that were carried forward from earlier scans of the same PR through the deduplication system. You also receive real-time notifications when new SCA issues are created during a PR scan. These notifications include the vulnerability title, affected package name, and CVE identifier so your team can assess impact immediately. When auto-patching is enabled, ZeroPath tracks the status of each patch PR. When a patch PR is merged, every linked vulnerability is automatically marked as **patched**. If the PR is closed without merging, the vulnerabilities are marked as **denied**. This works correctly even in monorepo configurations where a single patch PR may address multiple vulnerabilities at once. Both outcomes trigger notifications through your configured channels. When a patch PR is merged, you receive a **vulnerability patched** notification including the vulnerability title and branch name. When a patch PR is closed without merging, you receive a **patch PR denied** notification so your team can follow up on unresolved findings. ## Bot Commands You can drive ZeroPath directly from your PR or merge request by mentioning the bot in a comment — triage findings, assign tickets, generate patches, rescan, or ask natural-language questions. The bot acknowledges immediately and updates the same comment in-place when the action completes. A few common examples: ```text PR comment theme={null} @ZeroPath fp issue 2 because input is sanitized upstream @ZeroPath assign issue 3 to alice@example.com @ZeroPath generate patch issue 2 @ZeroPath rescan force @ZeroPath retriage because we added input validation ``` For the full command reference — every keyword, alias, target form, the `because` modifier, RBAC requirements, and platform support — see [Bot Commands](/scanning/bot-commands). When you change an issue's status via a bot command, a **vulnerability status changed** notification is sent through your configured notification channels. The notification includes the previous status, new status, and who made the change, so your team has full visibility into triage decisions made from PR comments. Bot commands are supported on **GitHub** and **GitLab**. **Bitbucket** and **Azure DevOps** support PR scanning but not bot commands yet. Use `@ZeroPath` as a universal alias, or replace it with your environment's configured bot username. Comments that appear to contain prompt injection content are automatically blocked. If you receive a rejection message, rephrase your question as a direct inquiry about the reported issue. If the PR references specific vulnerabilities using `ZP-ID` tags or dashboard issue URLs (see [Fix Verification](/scanning/fix-verification)), `retriage` re-runs fix verification against the latest PR code instead of the standard investigation flow. This checks whether the current PR changes actually resolve the referenced issues. If a fix verification is already in progress for the PR, the bot will let you know rather than creating a duplicate. ## Configuration All PR scanning settings follow an **Organization → Tag → Repository** inheritance cascade. Repository-level overrides take precedence. | Setting | Default | What It Controls | | ------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **PR scanning enabled** | Off | Master on/off switch for PR scanning on a repository. The current status is visible in the repository detail view and API response. | | **Inline review comments** | On | Post inline comments on affected diff lines | | **PR summary (issues found)** | On | Post a summary comment when the scan finds issues | | **PR summary (clean scan)** | On | Post a summary comment when the scan finds no issues | | **Detailed vulnerability info** | Not set | Include vulnerability descriptions, severity scores, and remediation details in PR summary comments. When not explicitly set, downstream settings apply. | | **Check status posting** | On | Post pass/fail check status to VCS | | **Result inclusion threshold** | 0 | Minimum score for a finding to appear in PR feedback | | **Check failure threshold** | 75 | Priority score at which the check is marked as failing. Must be greater than or equal to the result inclusion threshold. | | **Scan timeout** | 10 min | Maximum time before the scan is marked as timed out | | **Auto-patching on PR scans** | On | Generate fix suggestions for findings in the PR | | **Scan draft MRs** | Off | Whether to scan GitLab draft merge requests | | **Scan bot PRs** | Off | Whether to scan PRs opened by automation/bots | | **Tool toggles** | All on | Enable/disable SAST, SCA, Secrets, and IaC individually for PR scans | ## Automatic Repository Sync (GitHub) ZeroPath automatically keeps your repository metadata in sync when changes happen on GitHub. The following events are detected and handled in real time via webhooks: | Event | What Happens | | -------------------------- | ---------------------------------------------------------------------------------------- | | **Repository renamed** | The repository name is updated across ZeroPath, including all linked scan configurations | | **Repository transferred** | Ownership and URL are updated to reflect the new organization or user | | **Repository archived** | The repository is marked as archived in ZeroPath — no new scans will be triggered | | **Repository unarchived** | The repository is restored to active status and scans resume normally | | **Repository deleted** | The repository and its associated data are removed from ZeroPath | No manual action is required — these changes propagate automatically as long as the ZeroPath GitHub App is installed. ## How PR Scanning Differs From Full Scans | Aspect | PR Scan | Full Scan | | ---------------- | ----------------------------------------------- | ----------------------------- | | **Scope** | Changed files only (diff-focused) | Entire repository | | **Trigger** | Automatic on PR open/update | Manual, scheduled, or on push | | **Speed** | Fast (minutes) | Thorough (longer) | | **Differential** | Yes — subtracts existing target-branch findings | No | | **Results** | VCS check + inline comments + dashboard | Dashboard only | | **SCA gate** | AI decides if dependency files changed | Always runs | | **Timeout** | 10 minutes (configurable) | Longer timeouts | ## Adoption Guide Toggle it on in your repository's scanner settings. Ensure your GitHub App, GitLab installation, Bitbucket integration, or Azure DevOps connection is configured. ZeroPath will automatically scan it and post results. Add the ZeroPath check as a required status check in your VCS branch protection rules. Adjust the check failure threshold and result inclusion threshold to match your team's tolerance. Address findings directly in your code review workflow.