Scan a pull request by running fast checks on the changed files and dependencies, comparing the result with the base branch, and failing the check only on new high severity findings. This keeps the gate useful: developers fix what they introduced instead of inheriting every old finding.
What to run on a pull request
| Check | Why in the PR | Typical gate |
|---|---|---|
| Dependency scan | New or updated packages are the main new risk | New critical or high with a fix available |
| Secret scan | Cheapest place to catch a credential | Any live looking secret |
| SAST on changed code | Flaws are easiest to fix before merge | New high severity |
| Config scan on IaC and Dockerfile | Misconfigurations ship fast | Violations of the chosen baseline |
Steps
- Trigger the checks on every pull request and on pushes to the default branch.
- Scan the base branch for a reference result, then report only the difference.
- Post a short summary comment with the findings and fix hints.
- Make the check required in branch protection, otherwise it is advisory.
- Define an exception route with an owner and an expiry date.
- Decide what happens when the scanner is down. See block or pass when the scanner is down.
Make it trustworthy
A gate that fails often on old debt gets bypassed. Keep severity thresholds clear, allow a documented override, and track how often overrides happen. Also secure the CI job itself: pin the scanner version and limit its permissions. See hardening the job that runs your scanner.
Pull requests from forks
Forked pull requests run with fewer secrets for good reason. Do not hand scan credentials to untrusted code. Run the lightweight checks that need no secrets, and run deeper checks after a maintainer approves.
How Safeguard helps
Safeguard covers SBOM and dependency scanning, reachability analysis, and policies and gates that apply in pull requests. The free scan is a quick way to see your dependency findings.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch what blocks the merge and what only warns.
Quick check
Should the gate fail on all findings?
No. Fail on new high severity findings and manage older ones through a backlog.
Is a PR scan enough on its own?
No. New advisories appear after merge, so also run scheduled scans.
Last reviewed: 19 October 2026.
