> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sourcery.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and pull request checks

Security scanning can block a pull request from merging. It does this through the single **Sourcery review** check rather than a security check of its own: when a review finds a security problem in the diff, it posts a blocking comment that fails that check. The scheduled security scan is separate and reports to the dashboard.

## Where the scheduled scan reports

The [scheduled security scan](/security/scan-schedule/) runs against your default branch and reports to the dashboard. It is tied to the branch rather than a pull request or commit, so it posts to the dashboard and cannot be required in branch protection.

## Security findings in a review

The blocking comment is part of the normal [review](/reviews/anatomy-of-a-review/), and the check it fails is the same **Sourcery review** check every review reports. The check stays failed while a blocking security comment is unresolved.

## When a pull request fixes a finding

The reverse also shows up on the pull request. When a pull request removes code that a scan previously flagged, Sourcery marks the finding [solved](/security/findings/) and lists the findings the pull request resolves, each linked to its entry in the dashboard, so a reviewer sees the security impact of the change in context. This is part of [security scanning](/security/), so it runs when scanning is enabled on the repository.

## Requiring the check

If you want a blocking finding to stop the merge, require the **Sourcery review** check in your GitHub branch protection rules. That one check covers blocking security findings alongside everything else a review can block on. See [anatomy of a review](/reviews/anatomy-of-a-review/) for how the check moves between its states.