PR Scans
Two scans on every pull request: security on the diff, supply chain on dependency changes, with findings on the exact line and fixes as pull requests.
PR Scans is two checks from one GitHub App, on the same pull request, before merge. Together they answer: is the diff safe, and are the packages it adds safe?
Install the Superagent Security app on a repository. From the next pull request on, both scans publish GitHub check runs and inline review comments on the exact line, so your CI stays the source of truth. Free for open source: unlimited scans on public repos.
How they belong together
A pull request can ship a vulnerability in code you wrote, or in a dependency you bumped. One check cannot cover both well.
| Scan | GitHub check | Runs when | What it reviews |
|---|---|---|---|
| Security scanning | Superagent Security Scan | PR open and update | The diff: suspicious or malicious code, CI/CD workflow changes, unexpected install and build hooks |
| Supply chain scanning | Superagent Supply Chain Scan | A supported dependency file changes | Added or upgraded packages: npm, PyPI, Go, RubyGems, and GitHub Actions |
They run independently and complete as separate checks. You can require either or both in branch protection. You can turn either off per repository. A clean security scan does not imply a clean supply chain scan, and the reverse is also true.
The same app also posts a Contributor trust check on open and update. That scores who is behind the pull request, not what changed. See Contributor Trust. CLA coverage is a separate check from the Open CLA app; see Agreements.
Where results appear
On GitHub, findings sit as inline review comments on the exact line. Each scan completes as its own check run. Failed or action-required checks block merge when your branch protection rules require them.
In the dashboard, the repository detail page (/app/repository/[repositoryId]) lists recent pull request checks for the repo, next to the per-repo scan settings.
Configure scans per repo
Scan behavior is set per repository, not globally. Open a repository from Repository to turn Security scan and Supply Chain Scan on or off, and to review recent scans and finding dismissals.
Supply chain scanning is enabled by default on connected repositories. Security scanning is also on by default.
From finding to fix
Findings that need deeper work land in the Findings queue, where automated triage verifies them and one click turns a confirmed finding into a ready-to-review fix PR.