Concepts
Agents and severity
What each specialist agent looks for, and how findings are ranked.
Three agents review every pull request in parallel. Each has a narrow focus, so findings stay specific instead of repeating each other.
Code agent
Looks for correctness and maintainability problems in the changed code:
- Logic bugs and incorrect behavior in the main flow
- Edge cases that fail in common use
- Missing or insufficient tests for the change
- Code that is hard to follow or refactor safely
When the agent proposes a fix, the suggestion is actual code you can apply, not a description.
Security agent
Reviews like an attacker, based on the OWASP Top 10 and common real-world patterns:
- Injection: SQL, NoSQL, command, and template injection
- Missing authentication on new routes and weak session handling
- Access control gaps, such as reading another user's record by ID
- Secrets or personal data in logs, responses, or URLs
- SSRF, path traversal, XSS, and unsafe deserialization
- Hardcoded secrets and weak cryptography
- Unusual or unrecognized new package names that may be typo or hallucinated dependencies
The security agent flags only issues this pull request introduced or made worse. Problems that already existed in untouched code are skipped, so they are not reported as regressions.
Performance agent
- N+1 queries: a database query inside a loop
- Missing indexes on columns the change filters, sorts, or joins on
- Synchronous or blocking work in async code paths
- Unbounded fetches with no limit or pagination
- Memory leaks, such as listeners registered without cleanup
- Expensive work in hot paths and sequential awaits that could run in parallel
- Large payloads when only a few fields are needed
Severity levels
Every finding has one of five severities. High and Critical findings are treated as blocking.
| Severity | Meaning |
|---|---|
| Critical | Breaks the main flow: data loss, a security bypass, or a crash under normal conditions. |
| High | Fails in common edge cases or significantly degrades reliability or performance. |
| Medium | A real problem that should be fixed before merging, but will not cause an immediate outage. |
| Low | Worth a follow-up, not a blocker. |
| Info | An observation; no action required. |
Categories
Findings are also labeled with a category, which you can see on each finding in the dashboard:
BugSecurityPerformanceStyleRefactorDocumentationTestOther
Something unclear or out of date? Open an issue.