Ask six short questions: does this change touch authentication or permissions, add or update a dependency, handle personal data, change a workflow or deployment file, log anything sensitive, or add a secret or token? Keep them as checkboxes with a free text line, and let reviewers act on the ticked ones.
Why a template helps
A review is only as good as what the reviewer knows to look for. Authors know things the diff hides: that a new library came from a stranger, that a log line now includes an email address, that a workflow now has write access. A template pulls that knowledge to the surface at the moment it is cheapest to share.
It is not a gate. It is a prompt, so keep it short enough that people read it.
A template you can copy
Put this in the pull request template file for the repository.
## What changed and why
## Security check (tick what applies)
- [ ] Touches login, sessions, roles or permissions
- [ ] Adds or updates a dependency (name and reason below)
- [ ] Handles personal or customer data
- [ ] Changes a workflow, build or deploy file
- [ ] Adds logging that could include sensitive data
- [ ] Adds or changes a secret, key or token
## Notes for the reviewer
Six items fit on one screen. Resist adding a seventh.
Make the ticks mean something
Each box should trigger a reviewer action. Dependency changes go to the dependency scan result. Workflow changes need a code owner from the platform team. Permission changes need a second reviewer. If a box leads to nothing, delete it.
Pair the template with branch protection so required reviews and required checks exist. A template without enforcement is advice.
Keep it alive
- Look at ten recent pull requests each quarter. Are the boxes ticked honestly?
- Remove questions nobody ever ticks.
- Add one when an incident shows a gap, for example a missing check on a new category of change.
- Mention the template in onboarding, with an example of a good answer.
Aim for a culture where ticking a box is normal and brings help, not blame.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the gate demo and see how automated checks sit beside a human review.
Click through it at your own pace, or open it full screen.
Quick check
Should the template be required?
Templates are prompts. Use branch protection and required checks for enforcement.
Where does the template file live?
In the repository, so it versions with the code and changes go through review like any other file.
Sources
Last reviewed: 19 October 2026.
