PR Blocking

Overview #

DryRun Security can be configured to block pull requests from being merged when security findings exceed your defined thresholds. PR Blocking integrates with your source code management platform's native branch protection features to enforce security gates in your development workflow.

How It Works #

When PR Blocking is enabled, DryRun Security reports its scan results as a required status check on each pull request. If findings meet or exceed the configured severity threshold, the check is marked as failed, preventing the PR from being merged until the issues are resolved.

Blocking can be configured at two levels:

• PR Blocking Enabled (configuration level): When toggled on, any analyzer included in the configuration that produces a finding at or above the configured severity threshold triggers a failing blocking status for your SCM to enforce.
• Blocking (individual analyzer level): When toggled on for a specific analyzer, that analyzer blocks the PR on any finding it produces, regardless of severity or criticality.

Configuring PR Blocking #

1. Open the configuration for the repository you want to protect.
2. Go to Settings for the repository you want to configure.
3. Under PR Blocking, enable the blocking toggle.
4. Set the severity threshold. Findings at or above this level will block the PR. Options include:
   • Critical: Only block on critical severity findings.
   • High: Block on high and critical findings.
   • Medium: Block on medium, high, and critical findings.
   • Low: Block on all findings.
5. Configure your SCM's branch protection or merge request rules to require the DryRun Security status check.

Override Workflow #

When a finding is dismissed as False Positive or Won’t Fix / Nitpick, DryRun Security automatically clears the failing SCM check on the associated pull request. The block lifts as soon as the dismissal is processed, whether submitted from the PR thread or the Risk Register.

Dismissals marked as Accepted Risk, In Progress, or Resolved do not clear the SCM check. The pull request remains blocked until the finding is dismissed as False Positive or Won’t Fix / Nitpick.

All dismissal decisions are logged in the Risk Register for audit purposes.

Configure Blocking with GitHub Branch Protection #

These steps apply to both GitHub.com and GitHub Enterprise Server (GHES). The branch protection interface and workflow are identical on both, so GHES administrators can follow the same instructions.

The recommended approach is to configure a severity threshold at the configuration level. Any finding at or above that threshold will trigger the blocking flow across all agents.

For teams that prefer per-policy or per-analyzer blocking, that is still supported. After enabling Blocking on a specific policy or analyzer, follow these steps:

Set Up a Classic Branch Protection Rule #

1. On GitHub, navigate to the main page of the repository.
2. Under your repository name, click Settings.
3. In the Code and automation section of the sidebar, click Branches.
4. Choose Add classic branch protection rule.
5. Under Branch name pattern, type the name of the branch to protect (e.g., main).
6. Select Require status checks to pass before merging.

7. In the search field, search for the DryRun Security check you want to require. The following checks are available:

   Check name	What it covers
   Cross-Site Scripting Analyzer	XSS vulnerabilities across rendering contexts
   General Security Analyzer	Auth gaps, crypto issues, debug artifacts, and more
   IDOR Analyzer	Broken object-level authorization
   Mass Assignment	Unsafe model binding patterns
   Secrets Analyzer	Committed credentials, API keys, and tokens
   Server-Side Request Forgery Analyzer	SSRF via user-controlled outbound requests
   SQL Injection Analyzer	Unsafe query composition
   Code Policies	All custom code policies configured for your team

8. Click Create.

When a Custom Code Policy has Blocking enabled, it appears as a single Check in GitHub under the name Code Policies. When a Code Security Agent has blocking enabled, it appears as a Check with the agent's name (e.g., Secrets Analyzer).

GitHub Branch Protection Rules #

Use GitHub Branch Protection Rules to enforce DryRun Security checks before merging.

Require DryRun Security status checks to pass before merging.