# Merge gates

How merge gates review a fix pull request before it merges: the built-in and custom gates, required or advisory, automatic fix rounds and overrides.

*Where in the portal: Organization → Merge Gates*

*Last updated: 2026-10-21*

Merge gates are reviews a fix must pass before its pull request can be merged. Everyone in the organization can see the gates; only the owner can change them.

![The Merge Gates list: Security review marked Required, Code review and a custom gate marked Advisory.](https://kelrova.com/docs/img/organization/merge-gates.png)

*The Merge Gates list: Security review marked Required, Code review and a custom gate marked Advisory.*

## Which gates exist

Kelrova has two built-in gates, **Security Review** and **Code Review**. The owner can add instructions to a built-in gate, or create up to 10 custom gates with their own focus. The text of a gate only sets what it looks at. It cannot change the decision rule, in which a critical or high severity finding always rejects.

Custom gates never stand in for Security Review. Keep it on if you want security checked.

## What happens on a fix pull request

1. **A fix opens or updates a pull request**

   Every new version, whether a fix round, a manual push or a branch update, is reviewed again by each gate that is on. Results for older versions are replaced.

2. **Each gate reviews the change**

   The decision follows the findings. **Critical** and **High** reject the change. **Medium** and **Low** are shown and never block.

3. **A rejection goes back to the fix**

   A required gate's findings become the next fix round on the same pull request, up to 2 automatic rounds. After that, reply to the fix yourself or override.

4. **Merge opens**

   Once every required gate has approved the latest version, the pull request can be merged.

## Gate settings

| Setting | What it does |
| --- | --- |
| **Enabled** | The gate reviews every fix pull request. Turned off, it never runs. |
| **Required** or **Advisory** | A required gate must approve before merge and sends rejections back to the fix. An advisory gate shows its findings and blocks nothing. |
| **Can be skipped per fix** | Members with **Override merge gates** may leave the gate out when starting a fix. Turn it off to make the gate unskippable. |
| **Review security fixes** | Pull requests from **Fix it now** skip every gate by default, which saves credits. Turn this on for the gates that should review them too. |

## Overrides

Members with the **Override merge gates** permission can merge anyway by writing a reason of at least 10 characters. The override is recorded.

## Good to know

- Reviews use credits and wait in your organization's queue like any other job.
- A review that fails for a technical reason can be retried for free.
- Changing a gate's instructions re-runs it on open pull requests and spends credits.
- A new custom gate is created turned off. Its settings page sets **Enabled**, **Required** and **Can be skipped per fix**.

To start a fix, see [Go Fix: fix, re-check, ask](https://kelrova.com/docs/findings/go-fix).

## Related

- [Go Fix: fix, re-check, ask](https://kelrova.com/docs/findings/go-fix)
- [Severities](https://kelrova.com/docs/findings/severity)
- [Members and roles](https://kelrova.com/docs/organization/members)
- [Plans and the trial](https://kelrova.com/docs/organization/plans)