> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pull Request Scanning

> Security scanning for pull requests

Get security feedback directly in pull requests to prevent vulnerable code from being merged.

## How PR Scanning Works

PR scanning analyzes only the code changes in a pull request—faster than full repository scans.

### Differential Analysis

CodeThreat scans:

* ✅ Modified files
* ✅ New files
* ✅ Changed lines and surrounding context
* ❌ Unchanged files (skipped for speed)

**Result**: Faster scans (30 seconds to 2 minutes) with focused feedback on your changes.

***

## Enable PR Scanning

<Steps>
  <Step title="Open Repository Settings">
    Repository → **Settings** → **Pull Requests**
  </Step>

  <Step title="Enable PR Scanning">
    Toggle **Auto-scan on PR** to enabled
  </Step>

  <Step title="Configure Options">
    * Post PR comments
    * AI PR reviews
    * Block merge on failure
  </Step>

  <Step title="Save Configuration">
    Click **Save** to activate PR scanning
  </Step>
</Steps>

***

## PR Check Status

CodeThreat appears as a status check on pull requests:

| Status         | Description            | Actions                                 |
| -------------- | ---------------------- | --------------------------------------- |
| ⏳ **Pending**  | Scan in progress       | Wait for completion (typically 1-2 min) |
| ✅ **Success**  | No blocking violations | Safe to merge                           |
| ❌ **Failed**   | Security issues found  | Review and fix violations               |
| ⚠️ **Warning** | Non-blocking issues    | Consider fixing before merge            |

### Pass/Fail Criteria

Configure what causes a PR check to fail:

* Fail on Critical: Yes
* Fail on High: Yes
* Fail on Medium: No
* Fail on Low: No

<Tip>
  Start by failing only on Critical violations, then progressively tighten criteria as your security posture improves.
</Tip>

***

## PR Comments

When enabled, CodeThreat posts comments directly on your pull request.

### Summary Comment

Posted at the PR level with overall results:

* Security status
* Summary of violations found
* Top issues list
* Link to full results

### Inline Comments

Posted on specific lines with vulnerabilities:

* Issue description
* Security impact
* Fix recommendations
* Code examples

### Resolving Comments

1. Fix the vulnerability in your code
2. Push the fix
3. PR re-scans automatically
4. If issue is fixed, comment auto-resolves

***

## Branch Protection

Prevent merging vulnerable code with branch protection rules.

### GitHub Branch Protection

<Steps>
  <Step title="Open Branch Settings">
    Repository → **Settings** → **Branches** → Select branch (e.g., `main`)
  </Step>

  <Step title="Require Status Checks">
    Enable **Require status checks to pass before merging**
  </Step>

  <Step title="Select CodeThreat Check">
    Search for and select **CodeThreat Security Scan**
  </Step>

  <Step title="Save Rules">
    Click **Save changes**
  </Step>
</Steps>

***

## Best Practices

* Enable PR scanning for all repositories
* Use branch protection to enforce security gates
* Review PR comments promptly
* Fix critical issues before merging
* Use AI PR reviews for deeper analysis

***

## Next Steps

<CardGroup cols={2}>
  <Card title="AI PR Reviews" icon="code-pull-request" href="/ai/pr-reviews">
    Enable intelligent PR analysis
  </Card>

  <Card title="Automated Scanning" icon="repeat" href="/scanning/automated-scanning">
    Set up continuous scanning
  </Card>
</CardGroup>