01
Fetch the diff
Pull the GitHub patch and file context.
Measure every diff.
Catch issues before they ship.
Catch bugs, security issues, and slow patterns before they ship.
A finding. A fix. A test. All in context.
src/db/queries.py
140
def get_orders_for_user(user_id):141
query = "SELECT * FROM orders "142
query += f"WHERE user_id = '{user_id}'"143
cursor.execute(query)144
return cursor.fetchall()145
critical
SQL injection
User input is interpolated directly into the SQL query. This can be exploited to read or modify data.
Inspect findingFrom pull request to
a clear next step.
Heuristics and model analysis, working together.
02
Batch and cache
Group related hunks and reuse cached analysis.
03
Return findings
Surface issues with a clear fix and regression test.
Same diff.
Already measured.
Repeated hunks reuse cached results.
New code gets a fresh review.
- prompt version
- review-v1
- model
- configured model
- hunk
- sha256(file + added lines)
- Result
- CACHE HIT — model call skipped
A second pass, where it matters.
Security
Injection, exposed secrets, unsafe deserialization, and XSS.
query = f"SELECT * FROM users
WHERE name = '{user_input}'"
cursor.execute(query)Bugs
Mutable defaults, swallowed exceptions, and unfinished paths.
def parse(items, acc=[]):
try: return [acc.append(i) for i in items]
except Exception: passPerformance
N+1 queries, blocking I/O, and accidental quadratic work.
for order_id in order_ids:
items = db.query(Item).filter(
Item.order_id == order_id).all()