Troubleshooting
Last updated: Oct 26, 2026
The assistant does not review a pull request
Your code hosting platform shows no result and no comment, and the DevSecOps section of the group shows no row. Examine this list in this sequence.
| What you must examine | Where |
|---|---|
| On GitHub, the repository is inside the installation of the app | On GitHub, in the settings of the app |
| On Azure DevOps, the repository belongs to a project that existed when you connected | Integrations, SCM connections |
| The connection shows Connected | Integrations, SCM connections |
| The toggle of the group is on, below Pull request review | Integrations, SCM connections |
| The repository is a Git root of that group | Scope section of the group |
| That root is Active | Scope section of the group |
| The group has an active Essential or Advanced plan | Group information |
If you change the target branch of an open pull request, the assistant starts a new review against the new branch. You do not have to push a commit.
The result is Incomplete
The scan did not end, thus some vulnerabilities can be absent. The check reports a failure, because Fluid Attacks cannot tell you that your change is safe. The result does not tell you which part of the scan failed, because your action is the same in each case.
On GitHub, push a new commit or ask for a re-run of the check. On Azure DevOps there is no re-run: the only way out is a new commit.
An Incomplete result is not a result about your code. If a re-run and a new commit do not change it, contact Fluid Attacks.
The check does not show a change
| What you changed | What changes the check |
|---|---|
| You granted or revoked an exception | Nothing. The platform publishes a new check run on the same commit. If it tells you that it could not update the check, push a commit or ask for a re-run |
| The severity threshold | Ask for a re-run of the check. On Azure DevOps, push a commit |
| The exclusions of the root | Ask for a re-run of the check, or push a commit. On Azure DevOps, push a commit |
| The code | Push a commit |
The platform rejects an exception
The platform rejects a grant or a revocation that it cannot apply, instead of saving a decision that your code hosting platform does not obey.
| Message | What you must do |
|---|---|
| Another exception now covers some of these vulnerabilities | Open the Exceptions tab. A vulnerability has one active exception at a time |
| The pull request was reviewed again and some of these vulnerabilities are gone | Open the review again and select the vulnerabilities of the newest result |
| The repository is not connected for pull request reviews | Connect the account again, and make sure that the toggle of the group is on below Pull request review |
| Exceptions can't be granted because the pull request is closed | Nothing. A closed or merged pull request does not accept an exception |
| Only the person who granted this exception can revoke it. Other Group Managers can revoke it once the grantor stops managing this group | Ask the person who granted it |
| This exception was already revoked | Open the review again. Somebody revoked it before you |
| This pull request is no longer available | The review is gone from the platform. Examine the DevSecOps section of the group |
Exception EXC-1 saved, but the check couldn't be updated now means that the platform kept your decision and could not reach your code hosting platform at that moment. Push a new commit, or ask for a re-run, to apply it.
The platform rejects the connection
| Message | What you must do |
|---|---|
| Account already connected | The account belongs to another Fluid Attacks organization. Disconnect it there first |
| Connection refused. The installation could not be verified | Install the app again from GitHub |
| Waiting for an owner's approval | You are not an owner of the GitHub account. An owner must approve the request that GitHub emailed to them |
| GitHub didn't uninstall the app, so the connection was kept | Remove the app on GitHub, then disconnect again |
| The app is no longer installed on this account, so the connection was removed | Somebody removed the app on GitHub. Connect the account again |
| This connection was already removed by someone else | Nothing. Another person disconnected it while you were looking at the list |
| Pull request review needs an active Essential or Advanced plan | Make sure that the group has an active Essential or Advanced plan, then turn on its toggle again |
| The Fluid Attacks app is suspended on GitHub, so review cannot be turned on | Reactivate the app on GitHub, then click Verify again |
| Update required | An administrator must approve new permissions on GitHub. Everything already granted keeps working |
| This credential belongs to an SCM connection, disconnect it instead | Do not delete the credential. Disconnect the connection that created it |
The check is necessary, but GitHub permits the merge
The check reports the same result for a clean pull request and for a pull request that passes with exceptions. A branch protection rule cannot see the difference. Refer to GitHub.
Make sure also that you attached the check to the Fluid Attacks Platform app in your ruleset. Thus no other app can report the check in its place.
Azure DevOps: the connection is rejected
| What you see | What you must do |
|---|---|
| The sign-in does not accept your account | The organization must belong to a Microsoft Entra directory, and you must sign in with a work or school account of that directory. A personal Microsoft account cannot connect |
| Entra answers Need admin approval | A Global Administrator of the directory must approve the Fluid Attacks application one time |
| The setup stops and asks for an administrator | Your account is not a Project Collection Administrator of the organization. Only that role can give the Git permissions |
| The organization belongs to another organization | An Azure DevOps organization connects to one Fluid Attacks organization. Disconnect it there first |
| Azure DevOps refuses the Fluid Attacks app, so review cannot be turned on | Enable the Fluid Attacks application again in Microsoft Entra, then click Verify again |
Azure DevOps: a repository does not appear when you add repositories
A project that you create after you connect the organization is not covered by the connection, and its repositories do not appear in the list.
Click Connect SCM again on the same organization. The connection takes the projects that it lacks. You do not have to disconnect.
A repository that you create inside a project that already existed does appear. Only a new project needs this.
Azure DevOps: the status does not block the merge
The status alone does not block a merge. Add a Status check policy on the
target branch. Open Repos, Branches, the More options icon of the
branch, and Branch policies. Below Status checks, select +. Choose
the status fluidattacks/peer-reviewer-assistant. Set Policy requirement
to Required. Refer to Block the merges that disobey your
policy.
To edit the policies of a branch you must belong to the Project Administrators group, or have the Edit policies permission of the repository. This is not the same role that connects the organization.
GitLab: integration not working after setup
If, after completing the integration setup, you do not see a comment in the merge request (MR) comments indicating that the analysis has started, you may need to reconnect the integration. Follow these steps:
- Navigate to the Integrations section on the Fluid Attacks platform dashboard.
- Locate the GitLab Peer Reviewer Assistant card.
- Click the Edit button (or the corresponding management button) for the connected group.
- In the Manage GitLab Peer Reviewer Assistant Integrations window, disconnect the current integration.
- Repeat the integration setup process from the beginning.
- Click the Use integration button.
- Select the group and click Connect.
- Authorize the GitLab connection.
- Configure the integration details (GitLab project).
- Click Update to finalize.
This reconnection process will refresh the integration tokens and webhook configuration, ensuring that the Peer Reviewer Assistant can properly analyze MRs.
GitLab: token expiration and renewal
The integration tokens used by the GitLab Peer Reviewer Assistant have a 6-month validity period. After this period, the integration will stop functioning and will need to be renewed.
To renew the integration, follow the same steps described in GitLab: integration not working after setup to disconnect the current integration and redo the setup.
It is recommended to set a calendar reminder 6 months after the initial integration setup to ensure continuous operation of the security analysis.
Azure DevOps Peer Reviewer Assistant
Connect your Azure DevOps organization, select the groups that get their pull requests reviewed, and manage or disconnect the connection.
Use a configuration file
Learn to use configuration files for vulnerability scans with the Fluid Attacks scanners. Fluid Attacks offers SAST, SCA, DAST, CSPM and MAST security analysis.