Launch offerFree for individuals
Mesrai
All use cases
Use case · Security Teams

Shift security left. Every pull request.

Security teams are outnumbered by developers by orders of magnitude. Mesrai applies security review and your organization's security policies to every change, and escalates what needs a human.

Coverage
Every pull request
Policies
Org-wide rules
Pairs with
SAST & SCA
Start free See examples

How security teams use AI code review

Security teams use AI code review to apply security checks to every pull request rather than a sample. Mesrai's security agent looks for broken access control, injection, exposed secrets, weak authentication and unsafe configuration, and security teams add their own policies as rules that every repository inherits — complementing SAST and dependency scanning with review that understands intent.

I.

Why security review doesn't scale manually

  • 01

    One security engineer per dozens or hundreds of developers means most changes are never security-reviewed.

  • 02

    SAST finds known patterns but misses business-logic flaws such as missing ownership checks.

  • 03

    Findings arrive weeks later from a scan or pentest, when the author has moved on.

  • 04

    Security policies exist in documents developers don't read at review time.

II.

How Mesrai shifts security left

Security agent on every PR

Checks access control, injection, secrets, authentication and session handling, SSRF, unsafe deserialisation and sensitive data in logs — explained with a fix.

Your policies as code

Write organization rules such as 'every /admin route must call requireRole' at Critical severity; every repository inherits them.

Reasoning SAST can't do

The repository graph shows when a change removes a check other code relied on, or exposes an internal function publicly.

Memories for context

Tell Mesrai once — '@mesrai remember: PII must never appear in logs' — and it applies that knowledge in every review.

III.

Real-world scenarios

2 examples

Illustrative examples of the kind of change security teams make every week, and the review comment Mesrai would post.

Scenario 01

IDOR in a new endpoint

A developer adds an endpoint to download invoices. Authentication is checked; ownership is not.

src/routes/invoices.ts
app.get("/invoices/:id/pdf", requireLogin, async (req, res) => {
  const invoice = await Invoice.findById(req.params.id);
  res.send(await renderPdf(invoice));
});
MesraiSecurity agentMUST_FIX

Insecure direct object reference: any logged-in user can download any invoice by id. Scope the query to req.user.accountId and return 404 when it doesn't match.

Result: The most common real-world vulnerability class is caught in the pull request, not in a bug bounty report.

Scenario 02

A token written to the logs

Debug logging is added to an OAuth callback to diagnose a login issue.

src/auth/callback.ts
logger.info("oauth callback", { query: req.query, tokens });
MesraiSecurity agentMUST_FIX

This logs the OAuth tokens and authorization code to your log provider, where many people and systems can read them. Log the user id and outcome only.

Result: Credentials stay out of log storage, avoiding a rotation exercise and an incident report.

IV.

Set up a security-first review layer

Start from Mesrai's built-in security checks, then add your own policies as Critical rules.

  1. 1

    Enable security analysis for all repositories.

  2. 2

    Write organization rules for your top policies: authorization on admin routes, parameterised queries, no secrets in code.

  3. 3

    Add memories for data-handling principles, such as which fields count as PII.

  4. 4

    Route Critical findings to the security team for a second look on sensitive paths.

Organization rule — from the security-first pipeline recipe
Name: No raw SQL queries
Scope: File
Paths: **/*.ts, **/*.js, **/*.py
Severity: Critical
Instructions:
  Flag string concatenation or template literals used to
  build SQL queries. Require parameterized queries or an ORM.
V.

Who uses it, and how

AppSec engineers
Write policies once and review only the escalated, high-risk changes.
Developers
Learn secure patterns from findings that explain the risk and the fix.
CISO / compliance
Get evidence that every change was reviewed against security policy.
VI.

What teams achieve

Security review on 100% of pull requests, not a sample

Logic and access-control flaws caught alongside SAST findings

Security policies enforced where code is written

Developers learning secure patterns from every review

VII.

Security Teams — frequently asked

3 questions

  • Does Mesrai replace SAST?

    +

    No. Keep SAST and dependency scanning as automated gates. Mesrai adds review that understands intent — missing authorization, unsafe logic, policy violations — which pattern-based tools miss.

  • Can we enforce our own security policies?

    +

    Yes. Write them as organization rules in plain English with Critical severity; every repository inherits them, and folders can add stricter rules.

  • Which vulnerability types does Mesrai look for?

    +

    Broken access control, injection (SQL, NoSQL, command, LDAP), exposed secrets, weak authentication and sessions, SSRF, unsafe parsing and deserialisation, and sensitive data in logs, among others.

Further reading

Try it on your next pull request.

14-day free trial · every feature unlocked · no credit card required.

Start free

More use cases

Startups

A senior-engineer first pass on every pull request, before you can afford to hire one — so a small team ships fast without shipping regressions.

Read more
Engineering Managers

Shorter review queues, consistent standards across reviewers, and delivery metrics — without adding process or reading every diff yourself.

Read more
Enterprise Teams

Consistent review across hundreds of repositories, with SSO, audit logs, self-hosting and your own LLM provider for data control.

Read more