r/codereview • u/wak6817-2 • 1h ago
Rate my personal website
Not much to say here xd
My website, there are 2 subpages that you can check out!
r/codereview • u/wak6817-2 • 1h ago
Not much to say here xd
My website, there are 2 subpages that you can check out!
r/codereview • u/Emotional-Salary6293 • 48m ago
Principal software dev and responsible for a ton. The diff and pr diff aren't good enough. The size of the changes and complexity often need a walkthrough. I tried a few others, but they just weren't good enough. This has an MCP you can use to walk through changes or walk through any part of the codebase. I can quickly spot missing functionality or spot complexity that needs breakdown using this tool.
Adding a QA view that shows test coverage and gaps, with an MCP tool to allow your agent to suggest improvements to coverage as well. Hope it's helpful to someone who still needs to keep track of tricky changes.
r/codereview • u/mattjcoles • 1h ago
i built lgtmaybe, an open-source code reviewer, and a lot of the work went into making it usable on a local model. Big files get reviewed a hunk at a time, and big diffs get split to fit the context window, so a 27B model copes fine. The default is five model calls per review, which is fine on one GPU.
Which local models have you found actually good at code review? Keen to pick better defaults.
r/codereview • u/dany47898 • 13h ago
Maker here, full disclosure. After hitting "Hydration failed" in Cursor-built Next.js apps one too many times, I started collecting fixes. That turned into FixKit: paste the error and get the cause, the fix, and a follow-up prompt for Cursor/Lovable/Bolt. It's free to try: https://fixkit-ai.netlify.app/products/error-fixer.html
What error eats the most of your time? I'll write a guide for the top answers.
r/codereview • u/MightRare4568 • 7h ago
I’ve been building a tool where several AI models work on the same codebase. One makes the changes; the others review them.
About ten weeks in, the part I keep coming back to is what a reviewer’s approval is actually worth.
Early on, I’d get a “looks good” from the second model and feel more confident about the change. But reading back through the transcripts, I often couldn’t tell what it had checked. Had it opened the surrounding code? Run the tests? Or just read the diff and found nothing obvious?
That made the approvals hard to use, so I changed a few things:
There are still gaps. Passing tests don’t help much if the tests miss the bug. I’m wary of calling something “verified” when all we really know is that a particular set of checks passed.
The command restrictions also limit what reviewers can confirm, especially when a change needs writes or a deployment to test properly.
And I haven’t benchmarked this against ordinary review, so I don’t know how many additional bugs it catches. So far, the benefit is that I can see what an approval is based on.
How do you decide an AI-generated change is done? Do you rerun the tests yourself, trust the agent’s report, or have another model review it? If that second model approves without running anything, does its approval carry any weight for you?
Disclosure: I’m building LetThemBuild, by GPULogy AI. It’s free to try. I’ve left the link out of the post, but can share it in the comments if anyone asks.
r/codereview • u/Wonderful-Bass-8993 • 7h ago
r/codereview • u/Whole_Job_1222 • 13h ago
Repository-aware coding agents can still miss architecture that exists outside the repository.
I built AIP, an open-source MCP server that combines runtime observations, deployment information and architecture contracts to give agents evidence-qualified distributed-system context.
In the Pitstop demo, a change to MaintenanceJobFinished has 5 receivers on its messaging path, including ReportingService, which is not in the upstream repository the agent is reading.
AIP does not pretend to know which receiver actually uses StartTime or EndTime. That still requires source inspection.
The split I’m testing is:
architecture evidence tells the agent where to inspect; source analysis tells it what the implementation does.
Hosted demo, public and read-only, no account or token:
Source:
https://github.com/michaelegner/architecture-intelligence-platform
r/codereview • u/brewersgirl213 • 10h ago
r/codereview • u/Realistic-News-2123 • 12h ago
I tested two AI coding models on 10 real bugs from Koa's history:
• Sonnet fixed 7/10, $0.33 per bug
• Opus fixed 9/10, $0.75 per bug
At 1,000 bugs a year, if the gap holds: Opus costs $420 more but leaves 200 fewer bugs for your engineers. That's 200 hours saved.
On Express.js, the same test gave the opposite answer. Both fixed every bug, so Opus was just $360 more for nothing.
The right model depends on your codebase.
So I built unfix. It replays bugs your team already fixed and lets your own tests judge the AI. The test cost me about $8. Guessing costs you every month.
Small samples, one run each, so treat the scaling as an illustration. Then run it on your own code.
npm i -g unfix-ai
github.com/jubyuhanna-create/unfix
r/codereview • u/fykup • 12h ago
I've been experimenting with reviewing AI-generated code using a second model without spending additional coding-agent tokens or paying for API calls.
I built AI Badger, a free, open-source VS Code extension that packages your Git changes into a review prompt you can paste into ChatGPT, Claude, Grok, or another browser-based AI chat.
You can use free chat tiers or an existing subscription. No API key or separate AI service is required. Your normal chat usage limits still apply, but you're not consuming your coding agent's quota.

For more complex reviews, it also supports an iterative workflow where the reviewer can request additional repository context instead of guessing from the diff.
VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=pvrlabs.ai-badger
Article and walkthrough: https://pvrlabs.xyz/articles/reviewing-ai-generated-code-vscode-aibadger.html
I'm curious whether others use separate AI chats for code review or stick with their coding agent's built-in review tools.
r/codereview • u/Arjun_sharkar • 1d ago
Hi senior, i am a first year student,i want to start with web development.
So, please suggest me what is the best way to learn web developement.what should i do, should i do it with lecture or i can do it with freecodecamp.com, which would best to learn easily and take less time but teaches deeply not only basics.
r/codereview • u/No_Fail715 • 1d ago
r/codereview • u/Felix_Warren-56 • 2d ago
Everyone at my company is hyped about mermaid bc the diagrams live in the repo now. cool. they were also "living" in confluence and nobody updated them there either
the format was never the problem. nobody owns the diagrams, nobody reviews them, and the people who notice theyre wrong (support, sales, new hires) cant edit them anyway
someone convince me im wrong bc i have a meeting about this next week lol
r/codereview • u/Delicious-Milk-4891 • 1d ago
r/codereview • u/CrewPale9061 • 2d ago
Heads up if you still have gpt-4 or gpt-3.5-turbo somewhere in your code: OpenAI shuts them off on the API on Oct 23. gemini-2.5-pro on Vertex goes on Oct 20.
Those dates are all public, but they're spread over ~70 provider pages, so I wrote a small tool that checks them for you. It scans your repo for model IDs and tells you which ones are retired or about to be, and what to switch to:
npx @appliedbenchmark/sunset scan
error app.py:3:46 model-retiring
gpt-4 (openai) retires on 2026-10-23, in 11 days. Recommended replacement: gpt-5.6-sol (openai).
It covers OpenAI, Anthropic, Gemini, Vertex, Bedrock, Azure, Mistral and DeepSeek, and every date links back to the provider's own page. There's also a GitHub Action, so CI fails before a model disappears instead of after. IDs in comments and docs never fail the build.
No LLM, no telemetry, nothing leaves your machine. Free and Apache-2.0.
Github: https://github.com/AppliedBenchmark/sunset
It's v1, so if it misses an ID or gets a date wrong, let me know.
r/codereview • u/Old-Volume7330 • 2d ago
ArchRivet is an open-source, local MCP plugin that adds structured architecture reviews to your AI workflow.
I built ArchRivet to help developers review architecture decisions with clearer evidence, practical checks, and workload calculations. pls do check it out !!
https://github.com/Ujjansh05/archrivet/tree/main
What you get:
Spot potential design risks early — review retries, durability, queues, transactions, and more.
Understand the reasoning — findings include supporting references and suggested verification steps.
Expose missing details — identify assumptions your architecture needs to address.
Plan workload and storage — calculate traffic, message fan-out, and storage growth.
Connect through MCP — bring structured reviews into your AI assistant’s workflow.
Download complete model weights — the 322M model includes merged weights, tokenizer, and configuration.
Build on open source — inspect the code, run the examples, and contribute improvements.
let me know if you have any suggestions or think there’s room for improvement. I’d really appreciate your feedback!
r/codereview • u/DesignerSuspect464 • 2d ago
Apresento o AstrBot Brasil, uma adaptação feita especialmente para quem prefere utilizar o projeto em português do Brasil e com uma experiência mais acessível para a comunidade brasileira.
A proposta é facilitar o uso, melhorar a compreensão da interface e aproximar ainda mais o projeto de desenvolvedores e usuários do Brasil.
LINK: Astro Bot CLIQUE AQUI E CONFIRA
🚀 Projeto disponível no GitHub
🇧🇷 Adaptado para português do Brasil
💻 Código aberto
🤝 Contribuições da comunidade são bem-vindas
⭐ Se você gostar do projeto, deixe uma estrela no GitHub!
Quero continuar melhorando a versão brasileira e adicionando cada vez mais recursos.
Você usaria uma versão brasileira do AstrBot?
r/codereview • u/theepi_pillodu • 2d ago
r/codereview • u/NathanFeilder • 2d ago
r/codereview • u/Cheap-Bandicoot2653 • 2d ago
r/codereview • u/JaseciLabs • 2d ago
r/codereview • u/No_Breadfruit_1716 • 3d ago
I built Github merge gate which that checks whether developers understand their own code when they create a PR.
I kept getting sent PRs to review where it was obvious the author had pasted the ticket into an LLM and called it a day. Problem was: the PRs would often be massive 2K monstrosities that nobody could possibly review. As the team scaled up, this problem got only worse, and now we collectively have a system that no one understands and has bugs.
It works like this: when someone opens a PR, it posts a comment with a link. The author clicks through and answers a few technical questions about their own changes. If they can’t answer them, the PR can’t be merged.
It's self-hosted (so you can use it in your enterprise environments or privately)
It is BYOK (Anthropic) obviously.
Here is the source code, build instructions and how to deploy: https://github.com/bhurghundii/vibecheck.dev
I have two demos in the pull requests here: https://github.com/bhurghundii/vibecheck.dev/pulls - you can see what Vibecheck does (it blocks a PR for clearly showing no attempt vs a PR which gets it right)
I would love feedback, especially from anyone dealing with the same thing on their team. I do use it for my own projects a lot so expect improvements.
r/codereview • u/Exciting_Item_2732 • 3d ago
TL;DR: AI coding agents increased raw PR volume by 300%, yet overall merge velocity has dropped by 40% because Senior Engineers spend 15–20 hrs/week untangling 200-line hallucinated wrappers, deleted tests, and subtle CWE security flaws. After shipping patches into tier-1 upstream systems repos (LLVM #215076, Meta Velox #18529, DuckDB #26443, Apache DataFusion #24394, Microsoft Pyright #11605, Tokio #8595, ClickHouse #114954, OpenAI Triton #12221), we codified those exact deterministic CI gates into an open GitHub Actions workflow (ZeroSlop · Architecture & Simulator) that strips 94% of AI bloat, enforces 12 CWE security shields, and gets PRs merged 100% green in minutes.
When shipping patches into upstream systems repos like LLVM, Meta Velox, DuckDB, or Tokio, a real production fix is 4 to 15 lines of surgical invariant changes paired with a deterministic regression test that passes CI on the first push.
Inside commercial teams using Cursor, Copilot, or Claude Code, the opposite happens:
| Engineering Dimension | Conversational AI Review Bots | Deterministic PR Airlock (ZeroSlop) |
|---|---|---|
| Primary Objective | Leave 25+ chatty LLM comments on a bloated diff | Get PRs merged 100% green in minutes (not 4 days) |
| Diff Minimization | Reviews 200 lines of hallucinated wrappers as-is | Strips up to 94% of AI bloat down to the core AST invariant |
| CI Failure Triage | Ignores red CI checks or hallucinates fixes | Separates contributor code defects from runner flakes |
| Test Integrity | Misses deleted or weakened test assertions | Hard-blocks unauthorized regression test deletions |
| PR Comment Hygiene | Spams new threads on every git push |
Strictly 1 self-updating PR Verdict Card + Mermaid Graph |
| Security & Privacy | Cloud LLM retention & external dashboards | 12-Shield CWE Airlock + Zero Code Retention |
Every Pull Request is audited in milliseconds across 8 merge-readiness signals (0–100) and 12 deterministic CWE security shields before a human reviewer is pinged:
| Shield ID | Security Vector & CWE / CVE Mapping | What ZeroSlop Security Deterministically Intercepts |
|---|---|---|
| ZS-SEC-001 | SQL & Vector Injection (CWE-89 / CWE-943) |
Unparameterized SQL/NoSQL/Vector template literals & raw string concatenation |
| ZS-SEC-002 | Hardcoded & Seeded Secrets (CWE-798 / CWE-256) |
API keys, JWT secrets, seeded credentials & plaintext password comparisons |
| ZS-SEC-003 | Unbound Identity / IDOR (CWE-639 / CWE-862) |
Trusting req.body.userId instead of verified session/JWT caller identity |
| ZS-SEC-004 | Command & Eval Injection (CWE-78 / CWE-94) |
Unsanitized child_process.exec, os.system, subprocess(shell=True), eval() |
| ZS-SEC-005 | Silent Exception Swallowing (CWE-390) |
Empty catch () {} blocks and swallowed promise rejections that hide crashes |
| ZS-SEC-006 | XSS & Unsanitized DOM (CWE-79) |
dangerouslySetInnerHTML, .innerHTML =, and unescaped template rendering |
| ZS-SEC-007 | Unsafe Deserialization (CWE-502 / CWE-22) |
pickle.loads, yaml.load without SafeLoader, and ../ path traversal |
| ZS-SEC-008 | SSRF & Disabled TLS (CWE-918 / CWE-295) |
Unvalidated fetch(req.body.url) & NODE_TLS_REJECT_UNAUTHORIZED = '0' |
| ZS-SEC-009 | CI/CD "Pwn Requests" (CWE-426 / CWE-250) |
pull_request_target fork checkouts & ${{ github.event.pull_request.title }} injection |
| ZS-SEC-010 | AI Package "Slopsquatting" (CWE-829 / CWE-494) |
Hallucinated npm/PyPI/Cargo packages, unpinned Git deps & `curl |
| ZS-SEC-011 | Resource Exhaustion / DoS (CWE-400 / CWE-770) |
while(true) without exit bounds, leaked setInterval, unbounded Promise.all |
| ZS-SEC-012 | Trojan Source & Jailbreaks (CVE-2021-42574) |
Invisible Unicode Bidi characters & hidden IGNORE PREVIOUS INSTRUCTIONS comments |
These deterministic CI invariants come directly from shipping merged & 100% green Pull Requests across upstream systems repositories:
| Upstream Repository | Live Pull Request | Status | Core Systems Invariant & Regression Coverage |
|---|---|---|---|
| LLVM Compiler Infrastructure | llvm/llvm-project#215076 | MERGED | Fixed Waitcnt brackets in GFX12+ AMDGPUAsmPrinter with MC regression tests |
| Meta Velox Execution Engine | facebookincubator/velox#18529 | MERGED | Aligned DecimalUtil::toByteArray overflow bounds & restored kMaxDecimalBytes |
| DuckDB Analytical Engine | duckdb/duckdb#26443 | MERGED | Fixed pragma_storage_info internal compressed segment type alignment |
| Apache DataFusion Query Engine | apache/datafusion#24394 | MERGED | Fixed lead()/lag() window frame boundaries with non-NULL default values |
| Microsoft Pyright Type Checker | microsoft/pyright#11605 | MERGED | Resolved type narrowing across nested loop closures & pattern guards |
| Tokio Async Rust Runtime | tokio-rs/tokio#8595 | 100% GREEN | Preserved Coop budget accounting across JoinSet & FuturesUnordered |
| ClickHouse OLAP DBMS | ClickHouse/ClickHouse#114954 | 100% GREEN | Fixed StorageURL distributed cluster header forwarding & serialization |
| OpenAI Triton GPU Compiler | triton-lang/triton#12221 | 100% GREEN | Enforced strict tensor descriptor stride & block shape invariants |
| Cloudflare Agents SDK | cloudflare/agents#1248 | MERGED | Hardened state synchronization & WebSocket hibernation lifecycle invariants |
What deterministic CI gates or pre-review checks are your teams enforcing in 2026 to get PRs merged cleanly without burning out your staff engineers?
r/codereview • u/sudoanand • 3d ago
Enable HLS to view with audio, or disable this notification