Security and code-quality reviews for GitLab and GitHub

Security code review: understand the risk

A security review investigates how a proposed change affects the application's trust boundaries. For example, removing a workspace-scoping condition can let a lookup return another workspace's data. A useful finding identifies the changed code, explains the failure path, and gives the reviewer evidence to assess the impact.

Code Voucher keeps findings and raw evidence in the private dashboard. Provider summaries, inline feedback, and checks depend on explicit publication settings. Read the security and data-handling model for the boundaries around repository content, credentials, and external publication.

Code-quality review: assess correctness and maintainability

Code-quality review asks whether a change behaves as intended and whether the next developer can understand and maintain it. Findings can identify correctness risks, fragile assumptions, or missing validation. Severity, source context, and recommended next actions help the team decide which issues need a fix before merging.

Review runs record their outcomes and verification status. Evidence should distinguish an inspected code path from an executed check; a completed review is not proof that every test ran or every defect was found. See how review runs work.

Choose a GitLab or GitHub review workflow

GitLab merge request reviews

Connect a workspace service account, enable a repository, and open a merge request. The default workflow publishes a review status to the merge request pipeline without requiring a dedicated CI runner. Follow the GitLab quickstart or review GitLab connection requirements.

GitHub pull request reviews

Connect a GitHub.com App installation and explicitly enable selected repositories. Eligible pull request changes can produce private dashboard reviews. Summaries, inline findings, and native checks are separately enabled; signing in with GitHub alone grants no repository access. Read the GitHub setup guide.

From a review finding to a proposed fix

A finding explains the issue; a patch proposal is a separate, explicitly requested change. A workspace owner or administrator can request a focused fix for an eligible finding and inspect its private diff and validation evidence. Patch generation requires an eligible Codex review backend: the internal allowlisted dogfood backend, or a connected and acknowledged subscription backend where enabled by the deployment.

Publishing a validated patch is a separate action. Draft remediation merge request delivery is restricted to explicitly enabled internal GitLab repositories using the acknowledged dogfood backend. GitHub remediation pull request delivery is not available. Generated patches are not automatically merged, and validation does not guarantee correctness. See fix-proposal requirements and limits.

Does code review replace a security or code-quality audit?

Code Voucher reviews proposed changes in repository context. A full-repository security audit or code-quality audit has a broader, separately agreed scope: it may examine existing architecture, dependencies, configuration, and behavior beyond the merge request or pull request. Change review does not certify an entire codebase or establish regulatory compliance.

Teams evaluating code review tools should compare review scope, evidence quality, provider permissions, publication policy, and fix controls. Code Voucher's Agentic QA is a separate, first-party runtime-testing capability. Neither a source review nor a successful browser scenario guarantees application security.