Shift security left. Every pull request.

Mesrai's secret detector checks both the pattern match and the file path context. Files in test/, fixtures/, __mocks__/, or with a .test. extension trigger a lower confidence score on credential patterns — findings in those paths are flagged as Warning rather than Critical unless the pattern is a confirmed high-entropy real credential format (e.g. a 40-character hex string matching a known AWS access key prefix). You can also add path exclusions in .mesrai/config to suppress findings on specific directories entirely.

Yes. In repository settings, you can configure a severity block threshold: any PR with one or more open findings at or above the threshold is marked as 'Changes requested' and cannot be merged until those findings are either resolved or explicitly dismissed by a maintainer with override permission. Critical security findings — secrets, injection vulnerabilities, broken auth — are the most common use case for a hard block. Advisory comments for lower-severity findings remain unblocked.

Mesrai and SAST tools operate at different layers. SAST tools like Snyk and Semgrep use data-flow analysis and taint tracking on the full codebase — they are excellent at deep vulnerability paths that span many files. Mesrai operates on the PR diff with graph context — it catches the class of issues that require understanding what the code change is trying to do, not just what data flows where. Injection vulnerabilities that only make sense in the context of the surrounding business logic, missing input validation that a static rule would not flag, or a cryptographic choice that is only wrong given your threat model. The two approaches are complementary and most security-conscious teams run both.

Pulse tracks security findings by vulnerability category over time. If SQL injection findings are increasing across teams, that is evidence of a training gap on parameterised queries — not a rule miscalibration. You can export this data from Pulse as CSV and present the trend to leadership as a quantified risk surface: 'we saw 34 injection-class findings in Q1, up from 12 in Q4. Here is the training programme we are proposing and the reduction target for Q2.' This is typically more persuasive than a generic 'we need security training' request.