A GitHub App that reviews your pull requests with inline comments in under 10 seconds. Catches security issues, bugs, and code-quality problems across 4 languages — no setup required.
Each analyzer is tuned for the idioms and footguns of its language — no generic linting noise.
SQL injection, XSS, eval, hardcoded secrets, magic numbers, deep imports, any abuse.
Empty catches, broad exceptions, JDBC injection, resource leaks, raw generics, Thread.sleep.
Type hints, exception handling, mutable defaults, bare excepts, eval & exec abuse.
SQL injection, unserialize, weak crypto, type declarations, security best practices.
Every rule is tuned for a low false-positive rate. JPA annotations, common HTTP codes, and well-known numeric suffixes are whitelisted out of the box.
SQL injection in raw queries, eval() / new Function(), XSS via innerHTML, hardcoded credentials, weak randomness, dangerous deserialization. The kind of bugs that make the news.
Loose equality (== in JS, == on Strings in Java), empty catch blocks that swallow exceptions, broad catch (Exception) that hides programmer errors, off-by-one patterns.
Magic numbers, naming smells (handler2), wildcard imports, deep relative paths.
Thread.sleep() in production, blocking calls, resource leaks (no try-with-resources).
Missing Javadoc on public APIs, leftover TODO/FIXME/HACK, unresolved comments before merge.
Click Install on GitHub, pick which repos. Read access to code, write access to PR comments — that's it.
Open or update any pull request. The webhook fires the moment GitHub processes the event.
Inline comments land on the diff within seconds. Severity-tagged. With suggested fixes. No dashboards to check.
⚙️ Checked against 19 rules — 19 Java
| Severity | Count |
|---|---|
| High Risk | 3 |
| Mid Risk | 2 |
| Low Risk | 1 |
Reviewed 2 file(s)
UserService.java:42 — SQL built via string concatenation — SQL injection risk
UserService.java:67 — Empty catch block silently swallows exceptions
UserService.java:88 — Method name 'toResponse2' uses a numeric suffix — hides what differs