r/codereview • • 1h ago

Rate my personal website

• Upvotes

Not much to say here xd

My website, there are 2 subpages that you can check out!


r/codereview • • 48m ago

Made CodeDiver to Improve on Code Review Tooling

• Upvotes

Principal software dev and responsible for a ton. The diff and pr diff aren't good enough. The size of the changes and complexity often need a walkthrough. I tried a few others, but they just weren't good enough. This has an MCP you can use to walk through changes or walk through any part of the codebase. I can quickly spot missing functionality or spot complexity that needs breakdown using this tool.

Adding a QA view that shows test coverage and gaps, with an MCP tool to allow your agent to suggest improvements to coverage as well. Hope it's helpful to someone who still needs to keep track of tricky changes.

https://github.com/aitakemyjob/codediver


r/codereview • • 1h ago

Python Running PR reviews on a local model: what i learned building an open-source code reviewer

• Upvotes

i built lgtmaybe, an open-source code reviewer, and a lot of the work went into making it usable on a local model. Big files get reviewed a hunk at a time, and big diffs get split to fit the context window, so a 27B model copes fine. The default is five model calls per review, which is fine on one GPU.

Which local models have you found actually good at code review? Keen to pick better defaults.

https://github.com/MattJColes/lgtmaybe


r/codereview • • 2h ago

Any feedback on Scantonomous AppSec tool?

Thumbnail
1 Upvotes

r/codereview • • 13h ago

I built a fixer for the errors AI coding tools keep creating (free)

3 Upvotes

Maker here, full disclosure. After hitting "Hydration failed" in Cursor-built Next.js apps one too many times, I started collecting fixes. That turned into FixKit: paste the error and get the cause, the fix, and a follow-up prompt for Cursor/Lovable/Bolt. It's free to try: https://fixkit-ai.netlify.app/products/error-fixer.html

What error eats the most of your time? I'll write a guide for the top answers.


r/codereview • • 7h ago

I spent 10 weeks building a multi-model coding tool. Getting reviewers to run checks mattered more than getting them to agree.

1 Upvotes

I’ve been building a tool where several AI models work on the same codebase. One makes the changes; the others review them.

About ten weeks in, the part I keep coming back to is what a reviewer’s approval is actually worth.

Early on, I’d get a “looks good” from the second model and feel more confident about the change. But reading back through the transcripts, I often couldn’t tell what it had checked. Had it opened the surrounding code? Run the tests? Or just read the diff and found nothing obvious?

That made the approvals hard to use, so I changed a few things:

  • Reviewers can inspect files and run builds and tests on the same machine, with restrictions on what commands they can use.
  • The tool records the commands that actually ran, their exit codes, and their output. A model saying “tests passed” doesn’t count as evidence by itself.
  • An approval without any checks is marked “unverified.” If a reviewer approves while a check is failing, that gets flagged too.

There are still gaps. Passing tests don’t help much if the tests miss the bug. I’m wary of calling something “verified” when all we really know is that a particular set of checks passed.

The command restrictions also limit what reviewers can confirm, especially when a change needs writes or a deployment to test properly.

And I haven’t benchmarked this against ordinary review, so I don’t know how many additional bugs it catches. So far, the benefit is that I can see what an approval is based on.

How do you decide an AI-generated change is done? Do you rerun the tests yourself, trust the agent’s report, or have another model review it? If that second model approves without running anything, does its approval carry any weight for you?

Disclosure: I’m building LetThemBuild, by GPULogy AI. It’s free to try. I’ve left the link out of the post, but can share it in the comments if anyone asks.


r/codereview • • 7h ago

How are you using Codex to review PRs effectively?

Thumbnail
1 Upvotes

r/codereview • • 13h ago

Your coding agent can read the repo and still miss a downstream service

2 Upvotes

Repository-aware coding agents can still miss architecture that exists outside the repository.

I built AIP, an open-source MCP server that combines runtime observations, deployment information and architecture contracts to give agents evidence-qualified distributed-system context.

In the Pitstop demo, a change to MaintenanceJobFinished has 5 receivers on its messaging path, including ReportingService, which is not in the upstream repository the agent is reading.

AIP does not pretend to know which receiver actually uses StartTime or EndTime. That still requires source inspection.

The split I’m testing is:

architecture evidence tells the agent where to inspect; source analysis tells it what the implementation does.

Hosted demo, public and read-only, no account or token:

https://github.com/michaelegner/architecture-intelligence-platform/blob/main/examples/pitstop-demo/TRY_IT_HOSTED.md

Source:

https://github.com/michaelegner/architecture-intelligence-platform


r/codereview • • 10h ago

are you guys actually reviewing all the code your AI agents write?

Thumbnail
1 Upvotes

r/codereview • • 12h ago

10 bugs. 42 cents. Sounds tiny.

Post image
1 Upvotes

​

I tested two AI coding models on 10 real bugs from Koa's history:

• Sonnet fixed 7/10, $0.33 per bug

• Opus fixed 9/10, $0.75 per bug

At 1,000 bugs a year, if the gap holds: Opus costs $420 more but leaves 200 fewer bugs for your engineers. That's 200 hours saved.

On Express.js, the same test gave the opposite answer. Both fixed every bug, so Opus was just $360 more for nothing.

The right model depends on your codebase.

So I built unfix. It replays bugs your team already fixed and lets your own tests judge the AI. The test cost me about $8. Guessing costs you every month.

Small samples, one run each, so treat the scaling as an illustration. Then run it on your own code.

npm i -g unfix-ai

github.com/jubyuhanna-create/unfix


r/codereview • • 12h ago

Review AI-generated code in VS Code using free AI chats, no API keys required

0 Upvotes

I've been experimenting with reviewing AI-generated code using a second model without spending additional coding-agent tokens or paying for API calls.

I built AI Badger, a free, open-source VS Code extension that packages your Git changes into a review prompt you can paste into ChatGPT, Claude, Grok, or another browser-based AI chat.

You can use free chat tiers or an existing subscription. No API key or separate AI service is required. Your normal chat usage limits still apply, but you're not consuming your coding agent's quota.

AI Badger for VS Code: Copy Git changes and review them in any AI chat.

For more complex reviews, it also supports an iterative workflow where the reviewer can request additional repository context instead of guessing from the diff.

VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=pvrlabs.ai-badger

Article and walkthrough: https://pvrlabs.xyz/articles/reviewing-ai-generated-code-vscode-aibadger.html

I'm curious whether others use separate AI chats for code review or stick with their coding agent's built-in review tools.


r/codereview • • 1d ago

javascript Best way to learn full stack web development. Through youtube lectures or self-interective website like freecodecamp.com

5 Upvotes

Hi senior, i am a first year student,i want to start with web development.

So, please suggest me what is the best way to learn web developement.what should i do, should i do it with lecture or i can do it with freecodecamp.com, which would best to learn easily and take less time but teaches deeply not only basics.


r/codereview • • 1d ago

Are this level code reviews still reasonable in the age of AI?

Thumbnail
2 Upvotes

r/codereview • • 2d ago

Unpopular opinion putting diagrams in code doesnt make them living documentation

4 Upvotes

Everyone at my company is hyped about mermaid bc the diagrams live in the repo now. cool. they were also "living" in confluence and nobody updated them there either

the format was never the problem. nobody owns the diagrams, nobody reviews them, and the people who notice theyre wrong (support, sales, new hires) cant edit them anyway

someone convince me im wrong bc i have a meeting about this next week lol


r/codereview • • 1d ago

brainfuck BugHunt Daily #17: spot the bug in this JavaScript snippet 🐞

Thumbnail
1 Upvotes

r/codereview • • 2d ago

I made a small CLI that warns you before the AI models in your code get retired

0 Upvotes

Heads up if you still have gpt-4 or gpt-3.5-turbo somewhere in your code: OpenAI shuts them off on the API on Oct 23. gemini-2.5-pro on Vertex goes on Oct 20.

Those dates are all public, but they're spread over ~70 provider pages, so I wrote a small tool that checks them for you. It scans your repo for model IDs and tells you which ones are retired or about to be, and what to switch to:

npx @appliedbenchmark/sunset scan

    error   app.py:3:46  model-retiring
    gpt-4 (openai) retires on 2026-10-23, in 11 days. Recommended replacement: gpt-5.6-sol     (openai).

It covers OpenAI, Anthropic, Gemini, Vertex, Bedrock, Azure, Mistral and DeepSeek, and every date links back to the provider's own page. There's also a GitHub Action, so CI fails before a model disappears instead of after. IDs in comments and docs never fail the build.

No LLM, no telemetry, nothing leaves your machine. Free and Apache-2.0.

Github: https://github.com/AppliedBenchmark/sunset

It's v1, so if it misses an ID or gets a date wrong, let me know.


r/codereview • • 2d ago

Hi guys I’m a solo builder exploring how AI can help developers question architecture decisions before writing production code. That led me to build ArchRivet

0 Upvotes

ArchRivet is an open-source, local MCP plugin that adds structured architecture reviews to your AI workflow.

I built ArchRivet to help developers review architecture decisions with clearer evidence, practical checks, and workload calculations. pls do check it out !!

https://github.com/Ujjansh05/archrivet/tree/main

What you get:

Spot potential design risks early — review retries, durability, queues, transactions, and more.
Understand the reasoning — findings include supporting references and suggested verification steps.
Expose missing details — identify assumptions your architecture needs to address.
Plan workload and storage — calculate traffic, message fan-out, and storage growth.
Connect through MCP — bring structured reviews into your AI assistant’s workflow.
Download complete model weights — the 322M model includes merged weights, tokenizer, and configuration.
Build on open source — inspect the code, run the examples, and contribute improvements.

let me know if you have any suggestions or think there’s room for improvement. I’d really appreciate your feedback!


r/codereview • • 2d ago

Astro Bot Brasil — Uma versão adaptada para o público brasileiro

2 Upvotes

Apresento o AstrBot Brasil, uma adaptação feita especialmente para quem prefere utilizar o projeto em português do Brasil e com uma experiência mais acessível para a comunidade brasileira.

A proposta é facilitar o uso, melhorar a compreensão da interface e aproximar ainda mais o projeto de desenvolvedores e usuários do Brasil.

LINK: Astro Bot CLIQUE AQUI E CONFIRA

🚀 Projeto disponível no GitHub
🇧🇷 Adaptado para português do Brasil
💻 Código aberto
🤝 Contribuições da comunidade são bem-vindas
⭐ Se você gostar do projeto, deixe uma estrela no GitHub!

Quero continuar melhorando a versão brasileira e adicionando cada vez mais recursos.

Você usaria uma versão brasileira do AstrBot?


r/codereview • • 2d ago

What skills and models do you use for code vulnerability check against your repo using AI?

Thumbnail
1 Upvotes

r/codereview • • 2d ago

If AI is smart enough to find the bug, why was it dumb enough to write it?

Thumbnail
0 Upvotes

r/codereview • • 2d ago

I built a desktop code review app with Electron + React. Here's what I learned getting AI review to stop making things up

Thumbnail
0 Upvotes

r/codereview • • 2d ago

Stop letting your coding agent stack fixes on top of broken fixes

Thumbnail
0 Upvotes

r/codereview • • 3d ago

Python Vibecheck – a GitHub merge gate that checks whether you understand your AI-generated code

0 Upvotes

I built Github merge gate which that checks whether developers understand their own code when they create a PR.

I kept getting sent PRs to review where it was obvious the author had pasted the ticket into an LLM and called it a day. Problem was: the PRs would often be massive 2K monstrosities that nobody could possibly review. As the team scaled up, this problem got only worse, and now we collectively have a system that no one understands and has bugs.

It works like this: when someone opens a PR, it posts a comment with a link. The author clicks through and answers a few technical questions about their own changes. If they can’t answer them, the PR can’t be merged.

It's self-hosted (so you can use it in your enterprise environments or privately)

It is BYOK (Anthropic) obviously.

Here is the source code, build instructions and how to deploy: https://github.com/bhurghundii/vibecheck.dev

I have two demos in the pull requests here: https://github.com/bhurghundii/vibecheck.dev/pulls - you can see what Vibecheck does (it blocks a PR for clearly showing no attempt vs a PR which gets it right)

I would love feedback, especially from anyone dealing with the same thing on their team. I do use it for my own projects a lot so expect improvements.


r/codereview • • 3d ago

Why probabilistic AI review bots fail at catching AI agent bugs—and how we enforce deterministic AST invariants & 12 CWE security shields in GitHub Actions

0 Upvotes

TL;DR: AI coding agents increased raw PR volume by 300%, yet overall merge velocity has dropped by 40% because Senior Engineers spend 15–20 hrs/week untangling 200-line hallucinated wrappers, deleted tests, and subtle CWE security flaws. After shipping patches into tier-1 upstream systems repos (LLVM #215076, Meta Velox #18529, DuckDB #26443, Apache DataFusion #24394, Microsoft Pyright #11605, Tokio #8595, ClickHouse #114954, OpenAI Triton #12221), we codified those exact deterministic CI gates into an open GitHub Actions workflow (ZeroSlop · Architecture & Simulator) that strips 94% of AI bloat, enforces 12 CWE security shields, and gets PRs merged 100% green in minutes.

1. The 2026 Engineering Bottleneck: Why AI PRs Stall in Review

When shipping patches into upstream systems repos like LLVM, Meta Velox, DuckDB, or Tokio, a real production fix is 4 to 15 lines of surgical invariant changes paired with a deterministic regression test that passes CI on the first push.

Inside commercial teams using Cursor, Copilot, or Claude Code, the opposite happens:

  • 94% Diff Bloat: An agent generates a 240-line wrapper class instead of fixing a 4-line boundary condition (interactive diff breakdown).
  • Weakened Tests: When a test fails, the agent silently deletes or loosens the assertion to manufacture a green check.
  • Noisy LLM Review Bots: Conversational AI review bots run another LLM to dump 25 chatty comments on top of a bloated PR—without shrinking the diff or getting the PR merged.

2. Conversational LLM Review Bots vs. Deterministic PR Airlock

Engineering Dimension Conversational AI Review Bots Deterministic PR Airlock (ZeroSlop)
Primary Objective Leave 25+ chatty LLM comments on a bloated diff Get PRs merged 100% green in minutes (not 4 days)
Diff Minimization Reviews 200 lines of hallucinated wrappers as-is Strips up to 94% of AI bloat down to the core AST invariant
CI Failure Triage Ignores red CI checks or hallucinates fixes Separates contributor code defects from runner flakes
Test Integrity Misses deleted or weakened test assertions Hard-blocks unauthorized regression test deletions
PR Comment Hygiene Spams new threads on every git push Strictly 1 self-updating PR Verdict Card + Mermaid Graph
Security & Privacy Cloud LLM retention & external dashboards 12-Shield CWE Airlock + Zero Code Retention

3. The 12-Shield Deterministic CWE Security Airlock (ZS-SEC-001 – ZS-SEC-012)

Every Pull Request is audited in milliseconds across 8 merge-readiness signals (0–100) and 12 deterministic CWE security shields before a human reviewer is pinged:

Shield ID Security Vector & CWE / CVE Mapping What ZeroSlop Security Deterministically Intercepts
ZS-SEC-001 SQL & Vector Injection (CWE-89 / CWE-943) Unparameterized SQL/NoSQL/Vector template literals & raw string concatenation
ZS-SEC-002 Hardcoded & Seeded Secrets (CWE-798 / CWE-256) API keys, JWT secrets, seeded credentials & plaintext password comparisons
ZS-SEC-003 Unbound Identity / IDOR (CWE-639 / CWE-862) Trusting req.body.userId instead of verified session/JWT caller identity
ZS-SEC-004 Command & Eval Injection (CWE-78 / CWE-94) Unsanitized child_process.exec, os.system, subprocess(shell=True), eval()
ZS-SEC-005 Silent Exception Swallowing (CWE-390) Empty catch () {} blocks and swallowed promise rejections that hide crashes
ZS-SEC-006 XSS & Unsanitized DOM (CWE-79) dangerouslySetInnerHTML, .innerHTML =, and unescaped template rendering
ZS-SEC-007 Unsafe Deserialization (CWE-502 / CWE-22) pickle.loads, yaml.load without SafeLoader, and ../ path traversal
ZS-SEC-008 SSRF & Disabled TLS (CWE-918 / CWE-295) Unvalidated fetch(req.body.url) & NODE_TLS_REJECT_UNAUTHORIZED = '0'
ZS-SEC-009 CI/CD "Pwn Requests" (CWE-426 / CWE-250) pull_request_target fork checkouts & ${{ github.event.pull_request.title }} injection
ZS-SEC-010 AI Package "Slopsquatting" (CWE-829 / CWE-494) Hallucinated npm/PyPI/Cargo packages, unpinned Git deps & `curl
ZS-SEC-011 Resource Exhaustion / DoS (CWE-400 / CWE-770) while(true) without exit bounds, leaked setInterval, unbounded Promise.all
ZS-SEC-012 Trojan Source & Jailbreaks (CVE-2021-42574) Invisible Unicode Bidi characters & hidden IGNORE PREVIOUS INSTRUCTIONS comments

4. Upstream Systems Proof (Click Any PR to Inspect the Diff)

These deterministic CI invariants come directly from shipping merged & 100% green Pull Requests across upstream systems repositories:

Upstream Repository Live Pull Request Status Core Systems Invariant & Regression Coverage
LLVM Compiler Infrastructure llvm/llvm-project#215076 MERGED Fixed Waitcnt brackets in GFX12+ AMDGPUAsmPrinter with MC regression tests
Meta Velox Execution Engine facebookincubator/velox#18529 MERGED Aligned DecimalUtil::toByteArray overflow bounds & restored kMaxDecimalBytes
DuckDB Analytical Engine duckdb/duckdb#26443 MERGED Fixed pragma_storage_info internal compressed segment type alignment
Apache DataFusion Query Engine apache/datafusion#24394 MERGED Fixed lead()/lag() window frame boundaries with non-NULL default values
Microsoft Pyright Type Checker microsoft/pyright#11605 MERGED Resolved type narrowing across nested loop closures & pattern guards
Tokio Async Rust Runtime tokio-rs/tokio#8595 100% GREEN Preserved Coop budget accounting across JoinSet & FuturesUnordered
ClickHouse OLAP DBMS ClickHouse/ClickHouse#114954 100% GREEN Fixed StorageURL distributed cluster header forwarding & serialization
OpenAI Triton GPU Compiler triton-lang/triton#12221 100% GREEN Enforced strict tensor descriptor stride & block shape invariants
Cloudflare Agents SDK cloudflare/agents#1248 MERGED Hardened state synchronization & WebSocket hibernation lifecycle invariants

5. Architecture Documentation & GitHub Action Source

What deterministic CI gates or pre-review checks are your teams enforcing in 2026 to get PRs merged cleanly without burning out your staff engineers?


r/codereview • • 3d ago

Quick Intro to the New GitHub Stacked PRs

Enable HLS to view with audio, or disable this notification

3 Upvotes