Vidoc posts security findings directly to your GitHub pull requests, helping developers catch issues before merging.
Posted on specific lines of code where issues are found:
- Shows vulnerability type and severity
- Links to full issue details in Vidoc
- Appears in the PR’s “Files changed” view
A single comment summarizing all findings:
- Lists all issues found in the PR
- Groups by severity
- Posted once per scan
- Connect GitHub if not already connected
- Go to Settings → Integrations → GitHub
- Enable “Post PR Comments”
- Configure comment preferences
Configuration Options
| Setting | Description | Default |
|---|
| Inline comments | Comment on specific code lines | Enabled |
| Summary comment | Post summary of all findings | Enabled |
| Minimum severity | Only comment on issues at or above this level | Low |
| Comment on re-scan | Update comments when PR is re-scanned | Enabled |
Minimum Severity
Control noise by setting a minimum severity for PR comments:
- Critical only - Only comment on critical issues
- High and above - Critical + High
- Medium and above - Critical + High + Medium
- Low and above - All except Informative
- All - Include informative issues
Start with “Medium and above” and adjust based on your team’s preferences.
🔴 **Critical: SQL Injection**
User input flows directly into SQL query without sanitization.
**Remediation:** Use parameterized queries or an ORM.
[View in Vidoc →](https://app.vidocsecurity.com/...)
## Vidoc Security Scan Results
Found **3 issues** in this pull request:
| Severity | Issue | File |
|----------|-------|------|
| 🔴 Critical | SQL Injection | src/db.js:45 |
| 🟠 High | XSS | src/render.js:12 |
| 🟡 Medium | Open Redirect | src/auth.js:78 |
[View full report →](https://app.vidocsecurity.com/...)
- Push the fix to the PR
- Vidoc re-scans automatically (if auto-scan enabled)
- Resolved issues are marked as such in comments
To hide Vidoc comments from a PR:
- On GitHub, click the ”…” menu on the comment
- Select “Hide” → “Resolved”
This doesn’t affect the issue status in Vidoc.
PR Check Status
Vidoc can also report as a GitHub Check:
- Go to Settings → Integrations → GitHub
- Enable “Report as Check”
- PRs show Vidoc status in the checks section
Check Status Logic
| Result | Status |
|---|
| No issues | ✅ Passed |
| Issues below threshold | ✅ Passed (with annotations) |
| Issues at/above threshold | ❌ Failed |
- Go to Settings → Integrations → GitHub
- Disable “Post PR Comments”
Or disable per-repository in repository settings.
Related Pages
