Repository Settings

Repository settings decide where VULQN is allowed to review. A connected provider alone does not mean every repository is active.

Open Settings to manage source-control connections and repository coverage.

Connected providers

The settings page lists each active source-control connection:

• GitHub App connections.
• Bitbucket workspace connections.

From a connection section, you can sync repositories, enable or remove repositories from review coverage, and disconnect the provider.

Sync repositories

Use Sync repos when:

• A new repository was added after the provider was connected.
• GitHub App repository permissions changed.
• Bitbucket workspace access changed.
• A repository does not appear in the available list.

Syncing updates VULQN’s repository list for that connection. It does not automatically enable every repository.

Active and available repositories

Each connection has two repository lists:

List	Meaning
Active review repositories	VULQN can review PRs for these repositories.
Available repositories	VULQN can see these repositories, but they are not enabled for review.

Enable only the repositories where AI review should run. This keeps credit usage predictable and avoids adding review noise to repos that do not need it.

Branch targeting

Every active repository has a branch field. VULQN reviews a PR only when the PR target branch matches the field.

New repositories default to:

main,master

Use comma-separated branch names:

main,develop,release

Clear the field if VULQN should review pull requests to any target branch.

Note

Branch targeting in Settings is checked before .vulqn.json. If the settings branch filter skips a PR, the repository config file is not used for that PR.

Peer review per repository

Peer review is enabled per repository. Use it for repositories where a second validation pass is worth the extra capacity:

• Security-sensitive services.
• Payment, authentication, or authorization code.
• Critical libraries used by many teams.
• High-change repositories with frequent production impact.

Turning on peer review requires available peer credits. If no peer credits are available, VULQN blocks the toggle and prompts you to upgrade or buy peer credits.

If peer review is enabled but peer credits are exhausted when a review runs, VULQN falls back to a standard review and posts a warning on the PR.

Disconnecting a provider

Admins can disconnect a source-control provider. Disconnecting disables the connection and stops new automatic review events from that provider.

For Bitbucket, VULQN also attempts to remove the workspace webhook it created during setup.