# Pull request comments Get one comment on each GitHub pull request that adds a dependency with a known security advisory. A Deep feature, off until you turn it on. Pull request comments tell your team, in the pull request itself, when a change adds a dependency version with a known security advisory. This is a Deep feature, and it is off until you turn it on. ## What it does When a pull request is opened, gets new commits or is reopened, Lockpick reads your npm lockfile at two points: the pull request's head, and the point where its branch left the base branch (the merge base). It checks the exact versions in both against known security advisories. The check is deterministic. No code is run, and no AI reviews it. Lockpick compares the two lists, so it only blames the pull request for what the pull request adds. Problems that landed on your base branch after the branch was cut are not counted against it. It reads `package-lock.json` or `npm-shrinkwrap.json`, whichever you chose for the repository. Other lockfile formats, such as pnpm and Yarn, are not checked yet. ## Turn it on You need: * a site with its GitHub repository connected, under **Settings**, then **Repository**; * Deep or Master Key on the workspace; * the manage right on the site. Then open **Settings**, then **Repository**, and turn on **Comment on pull requests**. There is one switch per site. It is off by default. ## What the comment shows Lockpick keeps one comment per pull request and edits it in place. It does not post a new comment for each push. It comments only when the pull request adds a dependency version with a known advisory. If it adds nothing, and there is no comment yet, it stays quiet. The comment has: * a table of what the pull request adds. Each row shows the package, the version (and the version it replaced, when it is an upgrade), the severity, a **Known exploited** badge when attackers are already using the problem, a link to the advisory, and the version that fixes it; * a folded list of versions that were already vulnerable on the base branch, so you can see them without blaming the pull request; * a line saying how many advisories the pull request fixes. If the comment exists and a later commit fixes the problem, Lockpick edits the comment to say the pull request introduces nothing new. A stale warning does not stay behind. If Lockpick cannot read the lockfile, it says it could not check. This happens when the file is larger than 25 MB, is in another format, or is missing. It never says the pull request is clean when it did not read the file. ## Permissions The Lockpick GitHub App reads **Contents** and **Metadata**. For this feature it also needs **Pull requests** with read and write access, so it can read the pull request and post the comment. Lockpick uses short-lived tokens that are limited to the one repository. It does not merge, and it does not change your code. ### Existing installations If you installed the Lockpick GitHub App before this feature, you must accept the new permission on GitHub. The owner of the installation gets an email, and GitHub shows a banner on the installation's settings page. Until it is accepted, **Settings**, then **Repository** shows **Permission pending**, with a link to the installation. You can turn the switch on before then. It starts working when you accept. ## Allowance and limits Pull request comments spend no scan allowance. They do not create a scan. To keep things fair, Lockpick runs about 20 checks an hour for each pull request, and 600 an hour for each workspace. A check refused by a limit is dropped. The next push after the hour tries again, and it always reads the newest commit. ## Who it acts as The Lockpick GitHub App posts the comment, but the switch runs on the access of the manager who turned it on. * If that person loses access to the site, the feature turns itself off. Another manager can turn it on again. * If the workspace loses Deep, the feature pauses, and comments stop. It resumes by itself when you upgrade. ## Turn it off Turn off the switch, disconnect the repository, or choose another repository, and Lockpick stops. Comments already on GitHub stay there. Lockpick never deletes them. If you uninstall the Lockpick GitHub App on GitHub, Lockpick loses all access to the repository. ## If two sites use the same repository If two Lockpick sites connect the same repository, only one of them keeps the comment. The pull request still gets one comment, not two. > **Careful** > > A comment lists known advisories for the exact versions in your lockfile. It > is not a full security review. A pull request with no comment has not been > proven safe.