Datadog Code Security brings application-security findings into IDEs, continuous integration, and pull requests. For code reviews, its main capability is Static Code Analysis (SAST), which reports security vulnerabilities and code-quality problems before a change reaches production.
How Datadog helps during code review
Datadog Static Code Analysis scans source code for security vulnerabilities and quality problems before the code
reaches production. Teams can run scans on Datadog’s infrastructure or in CI with the datadog-ci CLI. Datadog
applies default language-specific rulesets, which teams can customize in the platform or in a
code-security.datadog.yaml file.
During a code review, Datadog can:
- Add inline comments for new SAST findings on pull requests in supported source-control systems.
- Report code vulnerabilities separately from quality findings such as error-prone code, performance problems, style violations, and poor practices.
- Provide deterministic or AI-generated suggested fixes when available.
- Create status checks that teams can use as pull-request gates.
- Associate findings with Datadog services and teams, helping route remediation work to an owner.
The current Datadog SAST documentation describes the supported languages, integrations, rules, and remediation options.
Pull-request comments and gates
Datadog supports inline SAST comments on cloud-hosted GitHub, GitLab, and Azure DevOps repositories. Teams can set minimum severity thresholds and exclude some lower-value findings, such as results in test files. Suggested fixes can be applied from a pull request when Datadog has a fix for the rule.
PR Gates are a separate enforcement mechanism. A gate can fail when modified lines introduce a new vulnerability or quality violation at a configured severity. Datadog creates the check, but the repository administrator must make that check required in GitHub or Azure DevOps before it blocks a merge. Gates can also use findings from software composition analysis, code coverage, infrastructure-as-code scanning, secret scanning, and flaky-test detection.
This focus on newly introduced problems is useful during review because an existing backlog does not have to block every pull request. See Datadog’s PR Gates documentation for the supported gate types and restrictions.
IDE feedback and remediation
Datadog extensions for Visual Studio Code and JetBrains IDEs can run static analysis while a developer edits code. That shortens the feedback loop by finding some violations before a pull request is opened.
For supported findings, Datadog distinguishes between deterministic fixes generated from rule templates and AI-suggested fixes for more complex violations. With the necessary GitHub App permissions, a developer can open a fix pull request from Datadog or commit a suggested fix to the current branch. These changes are proposals, not proof that a vulnerability is resolved; reviewers should inspect the patch and run the relevant tests.
Important limitations
Datadog’s pull-request comments and PR Gates are not supported for public repositories or for pull requests from a fork into a different repository. This makes the workflow a poor fit for many open-source projects.
Datadog Code Security is a broader platform rather than a lightweight standalone analyzer. It is strongest for organizations already using Datadog that want code findings, ownership, and production context in one system. A team that only needs a formatter, linter, or standalone static analyzer may find a smaller tool easier to operate.
Finally, static analysis only detects the patterns covered by its rules and analysis engines. It does not replace human review of requirements, design, business logic, tests, or operational risk.
Should you use Datadog for code review?
Datadog has a credible automated code-review workflow: SAST findings can reach developers in their IDE, CI pipeline, and pull requests, while gates can prevent selected new issues from being merged. The main reasons to choose it are its broader security coverage and its connection to Datadog’s service and runtime context.
If those capabilities are more than your team needs, compare the best automated code review tools or consider CodeQL for GitHub-native security scanning.
