PR / MR Security Comments

Overview

After a web scan completes, Shieldome can post a structured security summary as a comment on any GitHub Pull Request or GitLab Merge Request. This surfaces critical findings in the code review before the change is merged - no need to check a separate dashboard.

What the comment shows

The comment includes:

• The scanned target URL and security grade (A+ to F)
• Total finding counts by severity (Critical / High / Medium / Low / Info)
• A table of the top 10 critical and high findings with remediation hints
• A note with the count of remaining findings

Setup

GitHub

1. Create a Personal Access Token at Settings > Developer settings > Personal access tokens
2. Grant the repo scope (or pull_requests: write on fine-grained tokens)
3. In Shieldome, open a completed scan and click Post PR Comment
4. Paste the PR URL (e.g. https://github.com/myorg/myapp/pull/42)
5. Paste the token and click Post

GitLab

1. Create a Personal Access Token at User Settings > Access Tokens with api scope
2. In Shieldome, open a completed scan and click Post PR Comment
3. Select GitLab as the provider
4. Paste the MR URL (e.g. https://gitlab.com/myorg/myapp/-/merge_requests/15)
5. Paste the token (and your GitLab instance URL if self-hosted) and click Post

API

# Post a GitHub PR comment
curl -X POST https://app.shieldome.com/api/scan/SCAN_ID/pr-comment \
  -H "Content-Type: application/json" \
  -H "X-Shieldome-Key: YOUR_API_KEY" \
  -d '{
    "provider": "github",
    "pr_url": "https://github.com/myorg/myapp/pull/42",
    "token": "ghp_..."
  }'

# Post a GitLab MR comment
curl -X POST https://app.shieldome.com/api/scan/SCAN_ID/pr-comment \
  -H "Content-Type: application/json" \
  -H "X-Shieldome-Key: YOUR_API_KEY" \
  -d '{
    "provider": "gitlab",
    "pr_url": "https://gitlab.com/myorg/myapp/-/merge_requests/15",
    "token": "glpat-...",
    "gitlab_host": "https://gitlab.com"
  }'

Automating with CI/CD

To post a comment automatically after every PR scan, add a step to your pipeline:

# GitHub Actions example
- name: Post security summary to PR
  if: github.event_name == 'pull_request'
  run: |
    # Run the scan first (see GitHub Actions docs for full example)
    SCAN_ID=$(cat scan_result.json | jq -r '.scan_id')

    curl -X POST https://app.shieldome.com/api/scan/$SCAN_ID/pr-comment \
      -H "Content-Type: application/json" \
      -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
      -d "{
        \"provider\": \"github\",
        \"pr_url\": \"${{ github.event.pull_request.html_url }}\",
        \"token\": \"${{ secrets.GITHUB_TOKEN }}\"
      }"