Set up AI security review

Learn how to set up and configure AI security review for your projects

To set up AI security review, you need to complete the following tasks:

Install the GitHub App if you don’t have it already. See GitHub App for more information.

Ensure that you enable the following settings:

  • Pull Request Scans: Pull Request Scans allows Endor Labs to scan the pull requests. You must enable this setting so that AI security review can proceed for a pull request.
  • Pull Request Comments: Pull Request Comments allows Endor Labs to comment on a pull request in GitHub. This setting is optional, and you need to enable this setting if you want a comment on your GitHub pull request with the details of the AI security review. In addition, you also need to select Pull Request Comments in your scan profile and set up an action policy.

Create a scan profile for AI security review and configure the following options:

  • Pull Request Scans: Mandatory. This setting allows Endor Labs to scan the pull requests.
  • Pull Request Comments: Optional. This setting allows Endor Labs to comment on a pull request in GitHub.
  • AI Security Review Scans: Mandatory. This setting allows Endor Labs to scan the pull requests for AI security review.
  • Disable Code Summary: Optional. This setting allows you to disable the code summary for the AI security review.
  • Custom Prompt: Optional. You can enter a custom prompt to modify how AI security review detects and categorizes security-related changes.

Scan profile for AI security review

After you create the scan profile, assign the scan profile to the projects for which you want to set up AI security review.

See Scan Profiles for more information on creating a scan profile.

Ensure that the Security Review policy is enabled under finding policies.

  1. Select Policies & Rules from the left sidebar.
  2. Select Finding Policies.
  3. Search for Security Review and ensure that the policy is enabled.

Enable finding policy for AI security review

If you want to get comments on your GitHub pull requests, you need to set up an action policy.

  1. Select Settings from the left sidebar.

  2. Select Action Policies.

  3. Click Create Action Policy.

  4. Select Security Review as the Policy Template.

  5. Choose the severity threshold to trigger the AI security review.

    You can choose from the following severity thresholds:

    • Any
    • Low
    • Medium
    • High
    • Critical

  6. Select Pull Request as the Branch Type.

  7. Choose Enforce Policy as the action, and select Warn or Break the Build depending on your preference.

  8. Configure include and exclude patterns for the policy.

  9. Name the policy and provide a description.

  10. Enter tags if required for the policy.

  11. Click Create Action Policy to save the policy.

See Action Policies for more information on setting up an action policy.

Configure action policy for PR comments