Skip to main content
Ghost can review source code changes for a variety of security issues, including injection vulnerabilities, business logic vulnerabilities, authorization issues, and more.

Providers

Automated code reviews are supported for the following source code providers:

Review Concepts

The following review concepts apply to all supported providers.  Review Modes Set the Review Mode to control when Ghost will review code changes.
Review ModeDescription
DisabledCode reviews will not run.
AutoCode reviews will run automatically when a pull request is created, or when a draft PR is set to ready_for_review.
ManualCode reviews will only run in response to slash command comments (e.g. /ghost review).
 Minimum Severity Set the Severity Threshold to control the minimum severity of findings that will be reported.
ThresholdDescription
HighOnly high severity issues will be reported.
MediumOnly medium and high severity issues will be reported.
LowAll security issues will be reported.
 Custom Instructions Enable custom instructions to provide additional context and guidance for the Ghost code review agent to consider during analysis. When enabled, you can input specific instructions, coding standards, security requirements, or other guidelines that Ghost should apply when reviewing pull requests. Custom instructions help tailor the review process to your organization’s specific needs, ensuring that Ghost considers your unique requirements, architectural patterns, and security policies during code analysis. Custom instructions can be configured per repository and can be toggled on or off as needed. The maximum length for custom instructions is 2,500 characters.

Comment Reviews

Ghost code reviews are “comment” reviews rather than “approve” or “change request” reviews. This means Ghost code reviews do not count toward required approvals for the pull request. Final review decisions are made by a human reviewer on your team.

Review Types

 Full Review A full review of the code changes in the pull request. A full review will run automatically if Ghost Code Reviews are in auto mode. A full review can also be triggered manually with the /ghost review command if Ghost Code Reviews are in manual mode.  Check Review A re-check of all issues from a full review. A check review will run automatically on pull request synchronize events if Ghost Code Reviews are in auto mode. During a check review, if an issue is no longer present in the code changes, it will be marked as “resolved”. A human reviewer is still required to sign off and resolve the review thread itself. A check review can also be triggered manually with the /ghost check command.  Issue Review An issue review is a review of a single issue from a full review. An issue review can be triggered manually with the /ghost issue <keywords> command. During an issue review, if the issue is no longer present in the code changes, it will be marked as “resolved”. A human reviewer is still required to sign off and resolve the review thread itself.

Status Checks

Ghost code reviews report status checks to reflect the review status of the code changes.
Review ResultReview TypeCheck StatusReason
No security issuesFullsuccessNo action required
One or more issuesFullfailureOne or more security issues found
No security issuesChecksuccessAll issues resolved
One or more issuesCheckfailureOne or more security issues found
No security issueIssueaction_requiredA full review or check review is required to resolve remaining issues
Remaining issueIssuefailureOne or more security issues found

Commands

You can use slash commands to trigger several Ghost code review actions:
CommandDescription
/ghost reviewPerform a full review of the code changes.
/ghost checkRe-check issues from a full review (i.e. if there are code changes since the last review).
/ghost check <keywords>Check a single issue from a full review (i.e. if there are code changes since the last review).
/ghost helpShow help for the /ghost command.
Triggering a full review with the /ghost review will mark all existing issues as “superseded”, then perform a full review of the code changes in the current state.

Organization Settings

You can configure code review settings for your organization at https://app.ghostsecurity.ai/organization/reviews. Organization-level settings include:
  • Provider-specific review modes - Configure default review modes for GitHub and GitLab separately
  • Minimum severity thresholds - Set default minimum severity levels for each provider
  • Webhook secrets - Manage organization-wide webhook secrets (GitLab only)
  • Default project exposure - Set the default exposure level for new projects
These organization-level settings serve as defaults for all repositories. Individual repositories can override these settings as needed.

GitHub

To enable Ghost code reviews for GitHub, an existing GitHub connection in the Ghost platform is required.

Configure Organization Settings

Navigate to your organization review settings and configure the GitHub review mode and minimum severity threshold.

Customize Review Instructions (Optional)

Configure custom instructions at the repository level for tailored guidance specific to your team’s needs.
GitHub code reviews support all review concepts described above, including review modes, minimum severity thresholds, custom instructions, status checks, and slash commands.

GitLab

To enable Ghost code reviews for GitLab, an existing GitLab connection in the Ghost platform is required.

Access Token Permissions

To support merge request reviews, the GitLab access token used for the connection needs permission to set commit status. If reviews are enabled and the access token does not have this permission, reviews are tracked but not analyzed for security issues. Using standard GitLab permissions:
  • Role: developer
  • Scope: api
These permissions allow Ghost to post review comments and update commit statuses on merge requests.

Configuration Steps

Configure Organization Settings

Navigate to your organization review settings and configure the GitLab review mode and minimum severity threshold.

Generate Webhook Secret

Generate an organization-wide webhook secret in your organization review settings. This secret will be used to validate incoming webhook payloads from GitLab.

Configure GitLab Webhook

Configure the GitLab group webhook (see GitLab Webhook Configuration below for detailed steps).

Customize Review Instructions (Optional)

Configure custom instructions at the repository level for tailored guidance specific to your team’s needs.

Webhook Secret Configuration

GitLab code reviews require webhook secrets to validate incoming webhook payloads. Ghost supports two levels of webhook secret configuration: Organization-wide webhook secret:
  • Configured in your organization review settings
  • Applies to all GitLab repositories in your organization by default
  • Recommended for most use cases
Repository-level webhook secret:
  • Configured per repository for granular control
  • Overrides the organization-wide webhook secret when present
  • Useful for repositories that require isolated webhook validation
Webhook validation priority:
  1. If a repository-level webhook secret is configured, it will be used to validate the webhook payload
  2. If no repository-level webhook secret is configured, the organization-wide webhook secret will be used

GitLab Webhook Configuration

Navigate to GitLab Group Settings

Navigate to your GitLab group and go to SettingsWebhooksAdd new webhook.

Configure Webhook URL

Set the webhook URL to:
https://hooks.ghostsecurity.ai/webhooks/gitlab

Add Secret Token

Paste the webhook secret generated in your organization review settings into the Secret token field.

Select Trigger Events

Enable the following trigger events:
Comments
Merge request events

Save Webhook

Click Add webhook to save your configuration.
The webhook should be configured at the GitLab group level to cover all repositories within that group. You can also configure webhooks at the project (repository) level if you prefer granular control.
GitLab code reviews support all review concepts described above, including review modes, minimum severity thresholds, custom instructions, status checks, and slash commands.