GitHub Peer Reviewer Assistant
Last updated: Jun 24, 2026
Available only for cloud-hosted GitHub repositories. GitHub Enterprise Server (on-premises) is not supported.
Steps to configure the GitHub Peer Reviewer Assistant integration
This guide outlines the steps for configuring the GitHub Peer Reviewer Assistant integration within the Fluid Attacks platform. This integration enables an automatic peer reviewer to analyze pull requests (PRs) in GitHub and add inline review comments regarding security findings.
Activating this integration requires installing the Fluid Attacks GitHub App on your GitHub organization or repository. Contact your Customer Success Manager or write to [email protected] to request activation.
1. Request activation
- Contact your Customer Success Manager or send a request to [email protected].
- Provide the GitHub organization name and the repositories you want the Peer Reviewer Assistant to monitor.
- The Fluid Attacks team will install the GitHub App on your organization and link it to your group in the platform.
2. Verify the integration is active
Once the Fluid Attacks team has completed the setup:
- Open or update a pull request in one of the configured repositories.
- Confirm that the Fluid Attacks bot appears as a reviewer and that inline comments are posted on the changed lines where security vulnerabilities are detected.
How it works
Once active, the Peer Reviewer Assistant automatically analyzes each new or updated pull request in the configured repositories. When security vulnerabilities are detected, the integration posts inline review comments directly on the affected lines in the pull request diff, providing developers with immediate, actionable feedback.
There are also guides to integrate with GitLab and Azure DevOps.
Azure DevOps Peer Reviewer Assistant
Set up the Fluid Attacks Peer Reviewer Assistant for Azure DevOps to get automated vulnerability scanning and comments on pull requests.
Functionality
Learn how the Peer Reviewer Assistant analyzes code changes in pull requests and merge requests, reports security vulnerabilities as inline comments, and validates remediations.