# CI/CD and pull requests

> Review every pull request for security issues, and stop vulnerable code before it ships.

Airship plugs into your CI/CD pipeline and reviews every pull request for security issues. Vulnerable code is flagged before it can be merged, so it never reaches production.

## What it does on each pull request

- **Reviews the change.** The diff is analyzed for security issues in the context of your codebase.
- **Blocks vulnerable deploys.** A change with a confirmed problem is flagged before it merges.
- **Suggests the fix.** Findings come with a merge-ready fix and a retest.

## Beyond the pipeline

Pull request review runs alongside continuous monitoring. Your attack surface is watched around the clock, and new CVEs are tested against your systems as they're published. See [What Airship secures](/docs/targets).