--- title: Continuous PR Security Review — ProjectDiscovery Blog description: Security vulnerabilities introduced in PRs often look harmless in a diff because the real risk only surfaces at runtime. LLM-based code review tools help but... canonical: https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Continuous PR Security Review — ProjectDiscovery Blog | daily.dev og:description: Security vulnerabilities introduced in PRs often look harmless in a diff because the real risk only surfaces at runtime. LLM-based code review tools help but... og:url: https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt og:image: https://api.daily.dev/og/posts/T4wi10gZT.png og:image:alt: Continuous PR Security Review — ProjectDiscovery Blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Continuous PR Security Review — ProjectDiscovery Blog **[ProjectDiscovery Blog](https://daily.dev/sources/project-discovery)** · 12 min read · 0 upvotes · 0 comments ## Summary Security vulnerabilities introduced in PRs often look harmless in a diff because the real risk only surfaces at runtime. LLM-based code review tools help but suffer from low precision, causing alert fatigue. ProjectDiscovery's Neo addresses this by combining diff analysis with actual runtime testing: it spins up isolated sandbox environments, authenticates against staging deployments, and makes real HTTP requests to confirm whether vulnerabilities are exploitable. It catches three classes of issues that static review misses — ORM/framework defaults leaking data, business logic gaps with valid inputs, and incomplete state transitions. Neo integrates into GitHub PR workflows, posts findings with full HTTP evidence, creates Linear issues for confirmed High/Critical findings, and retests after fixes merge. It also accumulates codebase knowledge across reviews, improving accuracy over time. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#code-review](https://daily.dev/tags/code-review) [View this post on daily.dev](https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Continuous PR Security Review — ProjectDiscovery Blog","url":"https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt"},"datePublished":"2026-06-15T16:27:13.185Z","dateModified":"2026-06-15T16:27:39.333Z","description":"Security vulnerabilities introduced in PRs often look harmless in a diff because the real risk only surfaces at runtime. LLM-based code review tools help but...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cc6935920ca2a0f0f77572d29113d0c5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cc6935920ca2a0f0f77572d29113d0c5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ProjectDiscovery Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ProjectDiscovery Blog","logo":"https://media.daily.dev/image/upload/s--dG5jxdtR--/f_auto,q_auto/v1780213349/logos/project-discovery?_a=BAMAMiWQ0","url":"https://daily.dev/sources/project-discovery"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/continuous-pr-security-review-projectdiscovery-blog-t4wi10gzt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,code-review","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ProjectDiscovery Blog","item":"https://daily.dev/sources/project-discovery"},{"@type":"ListItem","position":3,"name":"Continuous PR Security Review — ProjectDiscovery Blog"}]} ```