ReviewPilot
10 deterministic checks+2 AI passes

Code review that thinks twice before it ships.

Scans for secrets, eval, and debug statements. Then two AI passes—one to review, one to validate—before inline comments land on your PR.

github.com/acme/payments/pull/142
PR
OPENFix auth flow#142
main ← feature/password-hardening
auth/login.ts+1 −1
12 async function handleLogin(req, res) {
13 const { email, password } = req.body;
14- if (user.password === password) {
14+ if (await verifyPassword(password, user.hash)) {
15 return createSession(user);
16 }
17 }
critic: 2 kept · 1 revised · 3 removedreview published
Review pipeline
status: running
01
Deterministic Analysis
12 checks complete
02
AI Reviewer
6 findings generated
03
Critic Pipeline
2 removed, 1 revised
Critic validating candidate findings
Next.js
TypeScript
Tailwind CSS
shadcn/ui
Framer Motion
Lucide
Python
FastAPI
OpenAI
SQLite
SQLAlchemy
GitHub

A three-gate quality pipeline.

Deterministic checks → AI review → critic validation. Each gate improves the signal.

> zero false positives
10 deterministic checks

Catches hardcoded secrets, eval(), empty exception handlers, debug statements, TODOs, and missing test files before AI even runs.

> gpt-4o-mini · JSON schema
Structured AI review

Up to 8 findings per review with severity, confidence scores, failure scenarios, and actionable suggestions—never raw stream-of-thought.

> second LLM pass
Critic re-evaluation

Every finding is re-judged: kept, revised, merged with duplicates, or removed. Static findings are protected unless the critic has strong reason.

> exact diff lines
GitHub-native publishing

A single review with inline comments mapped to real diff lines using the right-side line map. Summary in markdown with severity breakdown.

Two AI passes. Zero noise.

The reviewer generates structured findings. The critic keeps, revises, merges, or removes each one. Only useful signal ships.

1
Reviewer
Runs 10 checks + LLM analysis
2
Critic
Keeps, revises, merges, or removes
6
proposed
2
removed
1
revised
3
published
auth/login.ts:14highPublished

Plaintext password comparison

Passwords are compared with ===. Use a constant-time comparison function.

payments/charge.py:31highPublished

Missing input validation

user_id is read from POST without validation. Validate required fields.

api/routes.ts:42highPublished

Unawaited async call

The database query is async but not awaited.

payments/charge.py:58lowRevised

Currency hardcoded

Expanded to include configuration and account settings.

Currency is hardcoded to 'usd'. Consider reading from configuration.

auth/login.ts:19lowRemoved

Missing blank line

This file is missing a blank line after imports.

Too low impact; better handled by a formatter.
api/routes.ts:67lowRemoved

Variable name too short

Consider renaming x to transactionId.

Duplicate of an existing finding about naming.
GitHub inline preview
auth/login.ts
12 async function handleLogin(req, res) {
13 const { email, password } = req.body;
14+ if (user.password === password) {
15 return createSession(user);
16 }
17 }
Critic validated

Use a constant-time comparison function to prevent timing attacks.

Start free. Pro and Team coming soon.

Install on any public repo. No credit card, no trial expiration.

Free
$0

For open source and personal projects.

  • Public repositories
  • 10 reviews / month
  • 10 deterministic checks
  • AI reviewer (gpt-4o-mini)
  • GitHub inline comments
Install on GitHub

Pro and Team — join the waitlist

Private repos, 100+ reviews/month, critic validation, custom rules, SSO. Be the first to know when paid tiers launch.

Questions before installing?

Workflow, privacy, and access details for teams evaluating their next review system.

ready when you are

Put the next review where the code already lives.

Install on GitHub →