endor-review

Automating pre-PR security review involves analyzing branch diffs to perform incremental vulnerability, secrets, and license checks before merging. This Skill scans only changed files, applying guardrails to ensure scanning stays within the working branch.

An incremental pre-PR security scan evaluates only the changed files in a feature branch rather than the entire codebase. It targets dependency updates, source code changes, and configuration files to identify newly introduced vulnerabilities or leaked credentials.

Yes, MCP tools are required to execute vulnerability, SAST, secrets detection, and license compliance checks. The Skill acts as a security gate that orchestrates these external MCP tools to analyze your branch diffs before a merge.

Yes, license compliance and secrets detection run on configuration file updates, source code changes, and dependency updates. The pre-PR review analyzes all relevant diffs on the current branch to ensure policy compliance and safe merges.

The best way to prevent leaked credentials in a pull request is running an automated secrets detection scan on your branch diffs before merging. This pre-PR security gate identifies high-severity vulnerabilities and sensitive data in changed files.

The pre-PR security scan avoids scanning outside the working branch by applying strict guardrails to ensure only incremental diffs are evaluated. This prevents false positives from unrelated code and focuses solely on new issues introduced by the PR.