Skip to main content
Two parts of Cortex touch your repository, and they do opposite things. A Cortex Code session writes code: it edits files, runs commands, pushes a Cortex-owned branch and opens a pull request. Cortex Security reads a pull request: it reviews the change where it already is and posts its findings back onto GitHub, and it changes nothing in your tree. Security is part of Code rather than a separate application, which is why you reach it from inside the Code area and sign in once for both. This page exists so those two are never confused. It covers the boundary between them, how you get from a Code surface to Security, the three separate GitHub installs that the word “connect” can mean, and what a review deliberately will not do. Everything about how a review actually works, what a check run says and how the policy is set, is documented in the Cortex Security tab.

​
Writing a change, reviewing a change

The practical version: if you want something built or fixed, start a Code session. If you want a second pair of eyes on a change someone has already proposed, that is a review, and you do not start it from a session.

​
Reaching Security from Code

Security appears on several Code surfaces, and in each case it is a link rather than a setting.
  • The composer’s fourth row, Security. Under Ask, Plan and Agent there is a row labelled Security, with the hint Open Security mode for this repository. It is not a fourth interaction mode. Pressing it leaves the composer for Cortex Security and the session’s own interaction stays Ask, Plan or Agent. See Ask, Plan, Agent.
  • The quick action on Code Home, Run a security audit. The two quick actions beside it write text into the prompt box. This one navigates away, which is why it carries an outward arrow.
  • The badge Security mode is on. Home shows it when Security is active for the repository in front of you.
  • The command palette. Its navigate group has a Security row alongside Home, Sessions, Environments, Automations, Usage and Notifications.
  • An old bookmark. A /code/review link still lands on Security, so a saved link from before the move keeps working.

​
Three different GitHub installs

This is where the confusion usually happens. Three separate things install against GitHub, and having one of them gives you none of the others. So a repository that Code can open a pull request against is not automatically a repository Security reviews, and installing the Security App does not give a Code session anything it did not have.

​
What a review will not do

  • A failing review stays failed. The result is stored with the status the pass earned. It is not softened into a warning or rewritten as an approval so that a dashboard can look finished.
  • Nothing is pasted. There is no box anywhere in Security for pasting a patch. The change stays in the repository and Cortex reads it there, which is also why an older paste-a-diff review view was retired.
  • A review does not write your tree. Even when a finding arrives with a suggested change, applying it stays a human decision on GitHub. A session opened from a finding says so in its own words: The finding is on this branch. Approve in GitHub to apply it — Cortex never writes the tree from a finding.
  • A pull request cannot lower its own scrutiny. The review policy belongs to the installation and has its own screen in the app, described in Review policy.
Whether a failing check blocks a merge is GitHub’s decision, not Cortex’s. It depends on whether you have made the check a required one in your branch protection settings. See Checks and comments.

​
What the Security tab documents

Cortex Security

The map of the tab: what the product guarantees and where each page goes.

Security quickstart

Install the GitHub App, enable a repository, read a first review end to end.

How a review works

The stages a review moves through, and how a verdict is reached.

Checks and comments

The check run, the summary comment, inline findings, and asking for another pass.

Repository scans

Scanning a repository you own, rather than reviewing one pull request.

Cortex Agent runs

Evidence gathered by running a change, and why a run is never a pass on its own.