Skip to main content
Cortex Security reviews GitHub pull requests where they already are. You install its GitHub App on the repositories you want reviewed, and each pull request opened in them gets a review: inline comments on the lines, a summary comment, and a check run named Cortex Security. The product page says it in one line: GitHub pull-request review without pasting a diff. The change stays in the repository; Cortex reads it there. Security is part of Cortex Code rather than a separate application, so you reach it from inside Code and sign in once for both. This page is the map of the Security tab: what the product guarantees, where each page takes you, and how it differs from the other ways Cortex can look at a repository.

​
What Cortex Security guarantees

Three commitments shape every surface below, and they are worth reading before the feature list because they explain the shape of everything else.
The merge gate is GitHub’s, not Cortex’s. Whether a failing Cortex Security check blocks a merge depends on whether you made it a required status check in GitHub branch protection. See Checks and comments.

​
Start here

Security quickstart

Install the GitHub App, enable a repository, and read your first review end to end.

How a review works

The stages a review moves through, the second pass, and why the verdict is arithmetic.

​
Reviews and scans

Checks and comments

The check run and its three conclusions, the summary comment, inline findings, and re-running a review.

Review policy

When to review, what to look at, what to report, and how hard a finding lands.

Repository scans

On-demand and weekly scans of a repository you own, and what you can do with a finding.

Cortex Agent runs

Evidence gathered by running the change in an isolated runtime, and why a run is never a pass.

​
Configure

Installation and repositories

The installation, the repositories list, what the App asks for, and how to stop reviews.

Security troubleshooting

No check run, a review stuck, comments missing, or a finding that looks wrong.

​
How a review behaves

​
Three things called security

The word does a lot of work across Cortex, so keep these apart.

​
How it fits with the other products

Three GitHub-adjacent things exist, and reaching for the wrong one is the most common mistake.
  • The Cortex Security GitHub App reviews pull requests in place. It is installed from the Security surfaces and described in Installation and repositories.
  • Connect GitHub in Cortex Code is a separate connection, used for Code sessions. Neither install implies the other. See Connect GitHub.
  • The Cortex CLI can review a diff from within your own pipeline, which is a headless Code run rather than the Security App. Use whichever fits, or both. See Headless and one-shot runs.
A scan finding that comes with a suggested patch hands off into a Code session for you to read; nothing is applied for you. That is the seam between the two products: Security decides what is wrong, Code is where a change gets made.