# Polylane for security

> AI security review: Polylane checks every pull request that reaches production for flaws an attacker can exploit, traces each one through your code, and fixes vulnerable dependencies.

Catch the vulnerability before it ships. Polylane reviews every pull request that reaches production for flaws an attacker can exploit. It traces each finding from input to sink in your code, and drops the ones it can rule out.

- Every pull request that reaches production reviewed for security
- Each finding traced from attacker input to the vulnerable line
- Vulnerable dependencies fixed on the repos you deploy

## How it plays out

### It reviews every change that reaches production

Each pull request gets a Polylane security review check and a security section in the Polylane comment, alongside the impact analysis. A confirmed critical or high finding puts the merge on hold, with the file, the line and the fix.

### It proves each finding or rules it out

Pattern matchers flag the places worth a look. Polylane follows each one from the input an attacker controls to the line it reaches, and drops it when a check on the path makes it safe.

### It patches vulnerable dependencies on the repos you deploy

A daily scan finds vulnerable dependencies, files the most severe first, and opens a fix pull request only on repositories that are active and deployed.

## What Polylane checks before the merge.

- **A check on every pull request.** A Polylane security review check, with the findings in the same comment as the impact analysis.
- **Traced from source to sink.** Each finding names the input an attacker controls and every file and line on the way to the flaw.
- **Ruled out with a reason.** A candidate that turns out safe is dropped, with the file and line of the check that makes it safe.
- **Reads the code, never runs it.** Instructions written into a pull request are read as data, never followed.
- **Fixes vulnerable dependencies.** A daily scan of GitHub and GitLab repositories files the most severe vulnerabilities first and opens the fix.
- **Only where it matters.** Fix pull requests go only to repositories that are active and deployed.

## Learn more



## Questions

### Which pull requests does Polylane review for security?

Every pull request that can reach production.

### Does Polylane run my code or attack my endpoints?

No. It reads the source at the pull request's head commit.

### What does it look for?

Flaws an attacker can exploit: injection, authentication and authorization bypasses, cross-tenant access, SSRF, XSS, secrets in code, weak cryptography and more.

### How does it avoid false positives?

A pattern match is only a starting point. Polylane traces each candidate to an input an attacker controls, and rules it out when it finds the validation, escaping or ownership check that makes it safe.

### Can I turn it off?

Yes. Security reviews are on by default, with a switch for the workspace and one for each repository.

## More use cases

- [Polylane for impact analysis](https://polylane.com/use-cases/impact-analysis) ([markdown](https://polylane.com/use-cases/impact-analysis.md))
- [Polylane for DevOps](https://polylane.com/use-cases/devops) ([markdown](https://polylane.com/use-cases/devops.md))
- [Polylane as your AI SRE](https://polylane.com/use-cases/ai-sre) ([markdown](https://polylane.com/use-cases/ai-sre.md))
- [Polylane for Continuous Integration](https://polylane.com/use-cases/continuous-integration) ([markdown](https://polylane.com/use-cases/continuous-integration.md))
- [Polylane for ticket resolution](https://polylane.com/use-cases/ticket-resolution) ([markdown](https://polylane.com/use-cases/ticket-resolution.md))
- [All use cases](https://polylane.com/use-cases) ([markdown](https://polylane.com/use-cases.md))

Ship fast without shipping holes. Polylane reviews every change for security. Get started with one command: `curl -fsSL https://polylane.com/setup | bash` installs the CLI, connects your coding agents, and creates the account.