A pull request template should ask one yes or no question, whether the change adds or changes a third-party SDK or external API call, and if yes, require a link to the inventory row plus four short answers: data sent, credential location, failure behavior and owner. Keep it to a few lines so people fill it in.
Why use the pull request
The pull request is the last moment where the team has the context fresh and a second person is already looking. A question here costs a minute. The same question asked six months later, after a discovery scan finds the integration, costs a meeting. It also builds the habit that integrations are reviewed like code, which is how OWASP's guidance reads when it asks for inventory documentation to be generated and built in the pipeline.
Sample wording
Paste something like this into your template:
Third-party check
- Does this change add or modify a third-party SDK or external API call? (yes / no)
If yes:
- Inventory row link:
- Data sent (fields or data class):
- Where is the credential stored:
- What happens if the vendor is down:
- Owner:
Make it enforceable
| Level | How |
|---|---|
| Prompt only | The template asks, the reviewer checks |
| Light automation | A bot comments when the diff touches package manifests or adds a new hostname string |
| Gate | A check blocks merge when a new SDK dependency has no linked row |
Start with the prompt. Add the bot once people are used to the question, and add the gate for high-risk repositories first.
What reviewers should look for
- New hostnames in the diff. Strings that start with https and are not your own domains.
- New dependencies in manifests. A new vendor name in a lockfile or build file.
- New environment variables. Names that end in KEY, TOKEN or URL often mark an integration.
- Changed scopes. A new permission request in an OAuth client or an API console is a change to the row.
- New inbound routes. Webhook or callback handlers.
Keep it fair
If the template is long, people will click through it. Allow a quick "no" path. Provide an easy way to find the right row or create one, with a link in the template itself. Track how often the prompt catches something, and drop questions that never lead to a change.
When the change is a version bump
Upgrading an SDK is not always a new integration. Ask the question only when the change affects what is sent, which scopes are used, or which vendor endpoint is called. Routine patch updates can follow your normal dependency process.
Try it yourself
Open the demo and look at how a pull request gate presents its checks. Think about where the inventory row link would appear.
Click through it at your own pace, or open it full screen.
Quick check
Is a bot necessary?
No. Start with the template. Add a bot when you want consistent catching of new hostnames and dependencies.
Should every dependency bump trigger the prompt?
No. Only changes that alter data sent, scopes or endpoints need a row update.
Safeguard offers SBOM and dependency scanning and asset discovery that can feed this kind of inventory. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
