Code Reviews

Overview

Nullify reviews code across three layers: application-code vulnerabilities, dependency vulnerabilities, and leaked secrets. Application-code and dependency review run on pull requests and on the default branch, while secrets are checked on every commit across every branch — keeping security issues from reaching production.

Scanning Scope

Application Code Analysis

• Pull Requests: Reviews PRs targeting the default branch

  • Reviews the changed code in the diff

  • Posts inline review comments on findings

  • Reports a Nullify check whose pass/fail is configurable — informational by default, or a required gate on net-new findings

• Default Branch Commits: Reviews all commits pushed to the default branch

  • Full repository review on every push

  • Updates the dashboard with the complete inventory

  • Creates tickets and notifications for new findings

• Other Branches: Not reviewed for code vulnerabilities

Dependency Analysis

• Pull Requests: Reviews dependency changes in PRs targeting the default branch

  • Reviews changed manifest and lock files (package.json, pom.xml, Cargo.toml, etc.)

  • Contributes to the same tenant-configurable Nullify check gate

  • Identifies both direct and transitive dependencies

• Default Branch Commits: Full dependency review on every push

  • Analyzes all package manifest and lock files

  • Updates the dashboard with the complete vulnerability inventory

  • Drafts autofix PRs for upgradeable dependencies

• Container Images: Reviews container images for vulnerable packages

Secrets Detection

• All Branches, All Commits: Reviews every commit on every branch

  • Diff-scoped review

  • Notifies the commit author when secrets are found

  • Actively verifies detected credentials

  • Keeps secrets from entering git history

• Default Branch: Full git-history review on merge

  • Updates the dashboard with a repository-wide secret inventory

What Nullify covers

• Languages & frameworks — a wide range of languages plus infrastructure-as-code. See Supported Languages.

• Dependency ecosystems — npm, Maven, Go, PyPI, Cargo, and more, with reachability on supported languages. See Supported Ecosystems.

• Weakness classes — OWASP Top 10 and CWE Top 25 vulnerability classes, plus compound attack paths. See Supported Weaknesses.

Reachability & Exploitability Analysis

Nullify doesn't just report what a scanner matched — it reasons about whether a finding actually matters.

Code Analysis

• AI-driven triage analyzes how code is used in context.

• Screens out false positives before they reach you.

• Severity reflects exploitability, not just theoretical risk.

Dependency Analysis

• Direct vs. Transitive: marks whether the vulnerability is in a direct dependency.

• Reachability Analysis: on supported languages, traces whether a vulnerable package is actually reached by your code.

• Transitive and unreachable vulnerabilities are prioritized lower by default.

Secrets Verification

• Active validation: checks discovered credentials against the real provider.

• Tests API keys against actual services and validates token formats and expiration.

• Not just pattern matching — functional testing. See Secrets Detection.

Findings from all three layers are triaged together, then routed and remediated through Security Program Management and Remediations.