Syntic CodeAutomated security reviews

Automated security reviews in Syntic Code

Syntic Code can check the changes on your branch for security problems with the /security-review command, and you can run the same check automatically in your CI pipeline. A hosted service that reviews every pull request for you, without a CI job of your own, is not available yet.

Run a security review by hand

Open a session on your branch

Go to the repository, check out the branch with your changes and run syntic.

Start the review

Type /security-review. You can add a focus after it, for example /security-review the login handler.

Read the findings

The agent looks at what your branch changes compared with its base, checks for problems such as injection, unsafe handling of secrets and missing access checks, and leaves out low-value noise. It reports each finding with the file and the reason. It does not change your code unless you ask it to.

For a wider check, /ultrareview runs three passes side by side (correctness, security and tests) and merges the results by severity.

Run it automatically in CI

Any CI system that can run a shell command can run Syntic Code without a screen. A typical job:

Store a credential as a CI secret

Use a refresh token or an API key. See API keys and environment variables.

Install and run in read-only mode

Install Syntic Code in the job (install steps are coming soon; see Install Syntic Code), then run a one-shot review with syntic -p "…" and --permission-mode plan, so the agent can read but never change files.

Save or post the result

Add --output-format json to get a result your pipeline can read, then fail the job or post a comment as you prefer.

CI runs use your plan’s allowance like any other session. Cap a run with --max-turns or --max-budget-usd.

Good to know

  • A review is a second pair of eyes, not a guarantee. Keep your usual security testing.
  • The agent only sees what is in the repository and what it is allowed to read. Deny rules for secret files still apply during a review.
  • Administrators can block bypass and auto modes for everyone with an organization policy.

Learn more

Syntic Code security and privacySet up code review
Was this page helpful?