New in CodeRabbit Secure: Deep Scan now follows a vulnerability across your linked repos, then replays the exploit in a throwaway sandbox to prove it's real before it flags anything. Hendrik walks through this and everything else in the new update:

If you're more of a reader, check it all out here:

well, fixes are where the work actually starts red-teaming what's already in production comes first

Orange-teaming

security is becoming normal day-to-day engineering. following calls across connected repos is the part i didn't know i needed

nothing in the codebase is too old to be a target now. seeing which exposed endpoints are new since the last scan is a clean view

ai made exploits cheap to find. ranking every PR by security risk is the natural answer

excellent update considering agents writing much code in 2026 & beyond...

I wonder where it will be in 5 years time 😬

Every engineer touches security now. Having top models re-read old code makes that realistic.

When agents write code, review has to play attacker. Find the exploitable bug, confirm it's reachable, draft the fix. That's the loop.

My agentic coding now has security personnel

🫡

Keep you application and customer data secure, the the Deep Scan today

Love that it verifies the exploit before flagging it. Makes security alerts much more useful.

Security is daily engineering work now. evidence on every finding instead of a giant list is the way

Shift left is finally real. An independent check on each finding before it lands in your queue cuts a ton of noise.

not many more left shifts we can do 😅

Hell yeah!!

hell yeah! let test with my repos

GO GO

Whoa! I'm a huge fan of Coderabbit Secure and this is a really big feature add!

glad you like it Leonard!

Defenders need the AI attackers already have. Finding exploitable bugs, checking reachability and drafting the fix covers it end to end.

If agents write it, someone has to attack it before the real attackers do. Red-teaming shipped code covers that.

code needs watching through its whole life now. being able to trace calls across linked services is a big deal

i think a lot of vibecoders needed this asap amazing one team congrats🙏

hopefully we can help them stay safe!

@rrkhanna and the team has really cooked on this release. Some very powerful new features for folks to check out. needless to say, this couldn't come in a timelier moment!

most of the effort now goes into sorting findings, not finding them. a red-team sweep of production code sounds right

Shipped code is where I’d point Deep Scan first. A review from a year ago checked only for the attacks people knew then. Models have gotten better at finding exploits since then, so the same code needs another scan. Congrats on the launch 👏

code needs watching through its whole life now. tracing calls across linked services is a big deal

@HKrackDev spotted

exploit hunting is cheap now. watching code from the first commit to long after release feels like the right coverage

Reports nobody trusts just pile up. A red-team style sweep of code you've already shipped is far more useful.

teams that only find old bugs after an incident are in for a rough year. good timing on this one

False positives are quite literally why teams ignore these tools. Simulating it in a throwaway sandbox first is actually so smart.

Proven vulnerabilities, fewer false positives.

impressive as tracking vulnerabilities across linked repos helps catch risks that a single repo scan might miss.

✨👏

After this month's security debacle, this is great!

doing our part to prevent it happening further!

💟🌟 just bright energy all around