A security scan can find a high-severity vulnerability and the pull request can still be merged, because a scan only reports findings. Turn on Block merge when the gate fails in AngusGit and set the vulnerability gate threshold. Findings at that level block the merge. With branch protection, an administrator cannot bypass it either. This article covers how to pick a threshold, how to fix a blocked pull request, and the usual stuck states.