> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PR Comments

> Configure how Vidoc reports security findings in GitHub pull requests

Vidoc posts security findings directly to your GitHub pull requests, helping developers catch issues before merging.

## Comment Types

### Inline Comments

Posted on specific lines of code where issues are found:

* Shows vulnerability type and severity
* Links to full issue details in Vidoc
* Appears in the PR's "Files changed" view

### Summary Comment

A single comment summarizing all findings:

* Lists all issues found in the PR
* Groups by severity
* Posted once per scan

## Enabling PR Comments

1. [Connect GitHub](/github/setup) if not already connected
2. Go to **Settings** → **Integrations** → **GitHub**
3. Enable **"Post PR Comments"**
4. Configure comment preferences

## Configuration Options

| Setting                | Description                                   | Default |
| ---------------------- | --------------------------------------------- | ------- |
| **Inline comments**    | Comment on specific code lines                | Enabled |
| **Summary comment**    | Post summary of all findings                  | Enabled |
| **Minimum severity**   | Only comment on issues at or above this level | Low     |
| **Comment on re-scan** | Update comments when PR is re-scanned         | Enabled |

### Minimum Severity

Control noise by setting a minimum severity for PR comments:

* **Critical only** - Only comment on critical issues
* **High and above** - Critical + High
* **Medium and above** - Critical + High + Medium
* **Low and above** - All except Informative
* **All** - Include informative issues

<Tip>
  Start with "Medium and above" and adjust based on your team's preferences.
</Tip>

## Comment Format

### Inline Comment Example

```
🔴 **Critical: SQL Injection**

User input flows directly into SQL query without sanitization.

**Remediation:** Use parameterized queries or an ORM.

[View in Vidoc →](https://app.vidocsecurity.com/...)
```

### Summary Comment Example

```
## Vidoc Security Scan Results

Found **3 issues** in this pull request:

| Severity | Issue | File |
|----------|-------|------|
| 🔴 Critical | SQL Injection | src/db.js:45 |
| 🟠 High | XSS | src/render.js:12 |
| 🟡 Medium | Open Redirect | src/auth.js:78 |

[View full report →](https://app.vidocsecurity.com/...)
```

## Managing Comments

### Resolve Comments

When you fix an issue:

1. Push the fix to the PR
2. Vidoc re-scans automatically (if auto-scan enabled)
3. Resolved issues are marked as such in comments

### Hide Comments

To hide Vidoc comments from a PR:

1. On GitHub, click the "..." menu on the comment
2. Select "Hide" → "Resolved"

<Note>
  This doesn't affect the issue status in Vidoc.
</Note>

## PR Check Status

Vidoc can also report as a GitHub Check:

1. Go to **Settings** → **Integrations** → **GitHub**
2. Enable **"Report as Check"**
3. PRs show Vidoc status in the checks section

### Check Status Logic

| Result                    | Status                      |
| ------------------------- | --------------------------- |
| No issues                 | ✅ Passed                    |
| Issues below threshold    | ✅ Passed (with annotations) |
| Issues at/above threshold | ❌ Failed                    |

Configure the failure threshold in GitHub integration settings.

## Disabling PR Comments

1. Go to **Settings** → **Integrations** → **GitHub**
2. Disable **"Post PR Comments"**

Or disable per-repository in repository settings.

## Related Pages

<CardGroup cols={2}>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Configure GitHub integration
  </Card>

  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure automatic scanning
  </Card>

  <Card title="Pull Requests" icon="code-pull-request" href="/dashboard/pull-requests">
    View PR scan results
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Manage all security issues
  </Card>
</CardGroup>