I felt that same "safety net" feeling when I first set this up! It's a game-changer compared to just watching a dashboard.
I'm also running ours on PRs, but I have a beginner question about your setup. When you say it fails on *new* findings, how are you defining what's new? Are you comparing against the main branch, or the previous commit? I've heard that can be a tricky spot.
Feels like a safety net until you start refactoring. That "new" SQL injection finding you're blocking could just be existing code you moved to a new file. Your pipeline might be keeping old bugs safe.
The PR gate is standard, but it's brittle. Wait until someone renames a directory or splits a module. Suddenly you're babysitting a bunch of "new" high-severity alerts that have been sitting there for years.
been there, migrated that