Policy & Merge Checks
How Secbez maps findings to GitHub Check Run conclusions and how to enforce merge gates.
Secbez evaluates the new findings introduced by a pull request against your policy and emits a Check Run conclusion the rest of GitHub can act on (branch protection rules, required status checks, downstream automation).
How policy evaluation works
After scanning a pull request, Secbez:
- Filters findings to new items only (baseline findings are tracked but never gate the PR).
- Applies suppression rules (server-side and inline).
- Applies the configured severity / confidence thresholds.
- Picks the strictest matching outcome —
fail,warn, orpass.
The conclusion is reported on the PR as the Secbez Security Scan Check Run.
Default policy thresholds
| Condition | Action |
|---|---|
| Any critical severity finding | Fail |
| Any high severity + high confidence finding | Fail |
| Any high severity finding (any confidence) | Warn |
| Any medium severity finding | Warn |
| All other findings | Pass |
needs-review findings default to warn; you can configure them to gate or pass.
Enforcing merge checks
To prevent merging PRs that fail the security gate:
- Go to your GitHub repository Settings → Branches.
- Edit (or add) a branch protection rule for your default branch.
- Enable Require status checks to pass before merging.
- Select the Secbez Security Scan check.
Once enabled, PRs with a Failure conclusion cannot be merged until the issues are resolved or explicitly suppressed.
Customizing policy
Per-repository policy is editable from the dashboard's Settings → Policy tab. You can:
- Move thresholds up or down across severity / confidence buckets.
- Apply per-rule overrides (e.g., always fail on
SEC.SECRETS.AWS_SECRET_KEY, regardless of confidence). - Apply per-path policies (e.g., ignore findings in
__tests__/orvendor/). - Configure how
needs-reviewand low-confidence findings are treated.
Stricter policies catch more issues before merge. More permissive policies reduce friction but accept more risk — and ones that ignore high+high are no longer a meaningful gate.
Enterprise: custom policy engines
Enterprise deployments can plug in a custom policy module — e.g., one that consults an external risk-scoring service, applies tenant-specific overrides, or maps Secbez categories onto an internal compliance framework. See Enterprise → Customization.