> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews.md).

# Code Reviews

## Overview

Nullify reviews code across three layers: application-code vulnerabilities, dependency vulnerabilities, and leaked secrets. Application-code and dependency review run on pull requests and on the default branch, while secrets are checked on every commit across every branch — keeping security issues from reaching production.

## Scanning Scope

### Application Code Analysis

* **Pull Requests**: Reviews PRs targeting the default branch
  * Reviews the changed code in the diff
  * Posts inline review comments on findings
  * Reports a **Nullify** check whose pass/fail is [configurable](/configuration/configuration-pull-requests.md) — informational by default, or a required gate on net-new findings
* **Default Branch Commits**: Reviews all commits pushed to the default branch
  * Full repository review on every push
  * Updates the dashboard with the complete inventory
  * Creates tickets and notifications for new findings
* **Other Branches**: Not reviewed for code vulnerabilities

### Dependency Analysis

* **Pull Requests**: Reviews dependency changes in PRs targeting the default branch
  * Reviews changed manifest and lock files (`package.json`, `pom.xml`, `Cargo.toml`, etc.)
  * Contributes to the same tenant-configurable **Nullify** check gate
  * Identifies both direct and transitive dependencies
* **Default Branch Commits**: Full dependency review on every push
  * Analyzes all package manifest and lock files
  * Updates the dashboard with the complete vulnerability inventory
  * Drafts autofix PRs for upgradeable dependencies
* **Container Images**: Reviews container images for vulnerable packages

### Secrets Detection

* **All Branches, All Commits**: Reviews every commit on every branch
  * Diff-scoped review
  * Notifies the commit author when secrets are found
  * Actively verifies detected credentials
  * Keeps secrets from entering git history
* **Default Branch**: Full git-history review on merge
  * Updates the dashboard with a repository-wide secret inventory

## What Nullify covers

* **Languages & frameworks** — a wide range of languages plus infrastructure-as-code. See [Supported Languages](/capabilities/code-reviews/code-analysis/supported-languages.md).
* **Dependency ecosystems** — npm, Maven, Go, PyPI, Cargo, and more, with reachability on supported languages. See [Supported Ecosystems](/capabilities/code-reviews/dependency-analysis/supported-ecosystems.md).
* **Weakness classes** — OWASP Top 10 and CWE Top 25 vulnerability classes, plus compound attack paths. See [Supported Weaknesses](/capabilities/code-reviews/code-analysis/supported-weaknesses.md).

## Reachability & Exploitability Analysis

Nullify doesn't just report what a scanner matched — it reasons about whether a finding actually matters.

### Code Analysis

* AI-driven triage analyzes how code is used in context.
* Screens out false positives before they reach you.
* Severity reflects exploitability, not just theoretical risk.

### Dependency Analysis

* **Direct vs. Transitive**: marks whether the vulnerability is in a direct dependency.
* **Reachability Analysis**: on supported languages, traces whether a vulnerable package is actually reached by your code.
* Transitive and unreachable vulnerabilities are prioritized lower by default.

### Secrets Verification

* **Active validation**: checks discovered credentials against the real provider.
* Tests API keys against actual services and validates token formats and expiration.
* Not just pattern matching — functional testing. See [Secrets Detection](/capabilities/code-reviews/secrets-detection.md).

Findings from all three layers are [triaged](/capabilities/triage.md) together, then routed and remediated through [Security Program Management](/capabilities/program-management.md) and [Remediations](/capabilities/remediations.md).