Requirement status
Each security requirement has a status indicating whether it has been addressed:Severity levels
Severity indicates how urgent a requirement is and guides your response:Check status
Oplane posts an Oplane Security Review check on each PR/MR with one of these conclusions:
By default merge blocking is off and unresolved requirements report Neutral, which GitHub and GitLab treat as passing. Turn on Block merges on unresolved findings per repository and pick a severity on the slider to have the check report Fail when unresolved requirements reach a level you care about. Combined with your branch protection rules, this acts as a merge gate. See Check failure threshold.
Info severity is advisory and never contributes to the failure threshold, even at the lowest Low setting.
Comment structure
Oplane posts a single Oplane Security Review summary comment on your PR/MR and keeps it up to date as the review state changes. The comment contains:Summary headline
States how many requirements need attention and links to the generated threat model.Requirements table
Lists every requirement with its current status, title, and severity. Unresolved requirements are sorted first, ordered by severity (Critical → Info). Each unresolved row includes fix links to hand the requirement to your coding agent.Agent instructions
An instruction block embedded in the comment’s markdown, hidden in the rendered view. Coding agents can pick it up to fetch the threat model and report implementation status via MCP. See MCP setup.Working with Requirements
Learn how to respond to requirements and run local checks.