Security review on every pull request

QA tells you whether the change works. Now each pull request also gets a security review of what it changes, before it merges.

• What it looks for. Missing authorization or tenant scoping, IDs trusted from the request, injection, server-side request forgery, secrets in code, unsafe deserialization, prompt injection, agent and MCP tools with too much reach, and services that trust each other without checking.
• Every finding on a line. Each one names the file and the line the pull request adds, quotes it, rates it critical to info and says what to change. A finding that does not point at an added line is dropped, so nothing is reported without evidence. Secrets in the quote are masked.
• On the check and the pull request. A ZeusQA Security check carries the findings as annotations on the diff. Once a pull request has findings, one comment lists them and is updated on every push, down to "No security findings" when they are fixed.
• Only what changed. Lockfiles, generated, vendored, binary and removed files are skipped, the review reads at most 300 files and 100k characters of diff, and the comment lists what was left out.
• Limits. Pro reviews up to 100 commits a month and Team 500, at most 20 a day per workspace and 20 an hour per repository. Reviews are shared across ZeusQA, up to 40 a day for all workspaces together. A commit past a limit gets a neutral check that says which one, and re-running the check reviews it once the limit resets. A commit replaced by a newer push before its review starts, or a review that fails, does not count toward the month; every commit queued counts toward the day and the hour.
• Read, never run. The diff goes to the model as data between markers it cannot close, so a comment in the code that tells reviewers to stay quiet is read as code. Nothing in the repository runs, and the GitHub App needs no new permission.
• Each commit once. A redelivered webhook, a reopened pull request or an @zeusqa run to test again does not review the same commit twice; re-running the check does. Pull requests from forks and skipped drafts are reviewed when a member comments @zeusqa run, which also starts a QA run that counts toward the plan.

The check reports and does not block a merge yet. It is off until you turn it on: in Connections, GitHub, open a repository's settings and switch on Security review, and the next push gets its review.