CodeRabbit Secure: How Cross-Repository Security Agents Trace Vulnerabilities Across Dependency Graphs

CodeRabbit Secure has expanded its scanning capabilities to cross repository boundaries, following vulnerabilities through dependency graphs and verifying exploitability in isolated environments. The challenge lies in maintaining scan state when a single vulnerability in a shared library impacts multiple downstream repositories without causing an exponential increase in rescans or overwhelming teams with duplicate alerts.

Most security tools stop at the repository perimeter, scanning owned code and flagging issues, leaving cross-repo correlation to human analysts. CodeRabbit's new Deep Scan feature treats the dependency graph as the actual attack surface and coordinates agents to traverse it. The Deep Scan operates in three phases: establishing a baseline, traversing across repositories, and reconciling deltas.

During baseline establishment, the agent performs a comprehensive semantic analysis on the committed code in the target repository, building an internal graph of data flows, API boundaries, and external dependencies. This is not a diff scan but examines the entire codebase to identify vulnerabilities that may have been present for months or years.

When the agent detects a dependency link, it activates cross-repository traversal, spawning a new scan context in the linked repository. Each context maintains its own state but shares a correlation ID with the parent scan. After merges, delta reconciliation runs, revisiting only the changed files and areas where earlier verification results have become stale, keeping security coverage current without repeating expensive full scans.

The agent manages three types of state: scan state, correlation state, and verification state. Scan state includes the current position in the dependency graph, visited nodes, and pending branches. Correlation state maps findings in different repositories that trace back to the same root cause. Verification state contains runtime sandbox results, exploit confirmation status, and fix validation.

When crossing into a linked repository, the agent serializes the current scan context and passes a limited subset to the new scan, including the vulnerability signature, the call chain leading to the boundary crossing, and a recursion depth counter to prevent infinite loops. If a circular dependency is detected, the agent stops traversal at a configurable depth limit, typically three hops.

Runtime verification uses throwaway sandboxes to confirm exploitability. Static analysis may produce false positives, as a code path that looks exploitable might be unreachable at runtime or neutralized by input validation elsewhere. CodeRabbit's sandbox, a containerized copy of the application with instrumentation hooks, executes the exploit attempt and monitors for successful exploitation, marking the finding as confirmed if successful or downgrading the severity if it fails.

To reduce alert noise, CodeRabbit correlates findings by root cause. When the same vulnerability signature is detected in multiple repositories, it checks for common dependencies and creates a single parent finding with links to downstream occurrences. Developers receive one actionable item instead of 50 duplicates. CodeRabbit employs a coordinator-worker pattern for orchestration, with the coordinator receiving scan requests, building the dependency graph, and dispatching worker agents to scan individual repositories.

If a worker requests cross-repo traversal, the coordinator checks if that repository is already being scanned and merges scan contexts instead of spawning a duplicate worker. Workers communicate through a message queue and track scan progress in a distributed state store to handle failures and retries.