NewCodebase Q&A with line-level citations

ReviewFlow reads every pull request across five engineering pillars, cites the exact lines behind each finding, and never writes to your repo without your approval.

Start freeOpen the demo
acme/payments-api · #482 Add user search endpoint
38 router.post('/users/search', async (req, res) => {
39 const { name } = req.body;
40- const rows = await db.query(`SELECT * FROM users WHERE name = '${name}'`);
41+ const rows = await db.query(`SELECT * FROM users WHERE name LIKE '%${name}%'`);
42 res.json(rows);
HighSecurity · SQL injectionL41

User input is interpolated into the query string. An attacker controls the WHERE clause.

evidence: req.body.name → db.query [src/routes/users.ts#L39-L41]

100%

precision on the security benchmark

0%

false-positive rate in testing

5

engineering pillars per review

0

writes without your approval

FIVE PILLARS · 01 / 05

One review.
Security and four more lenses.

Injection paths, leaked secrets, unsafe deserialization. Found by a deterministic AST scan first, then explained by the model.

SecurityHigh

src/routes/users.ts

Unvalidated input reaches a SQL query

- db.query(`... WHERE name = '${name}'`)
+ db.query('... WHERE name = $1', [name])

cited from the diff · line verified

CorrectnessMedium

src/jobs/sync.ts

Promise rejection is never handled

- sendReceipt(order);
+ await sendReceipt(order).catch(logFailure);

cited from the diff · line verified

PerformanceMedium

src/lib/match.ts

Quadratic lookup inside a loop

- items.filter(i => ids.includes(i.id))
+ const set = new Set(ids); items.filter(i => set.has(i.id))

cited from the diff · line verified

TestingLow

tests/billing.test.ts

Skipped suite left in the pull request

- describe.skip('invoice totals', ...)
+ describe('invoice totals', ...)

cited from the diff · line verified

MaintainabilityLow

src/types/api.ts

Explicit any hides a type error

- function parse(body: any) {
+ function parse(body: ParseInput) {

cited from the diff · line verified

CODEBASE Q&A

Every answer links to the files and line ranges it came from, so you can verify in one click instead of trusting a paragraph.

  • Grounded in your indexed code, not guesses
  • Citations you can open at the exact lines
  • Works across every connected repository
SAMPLE CONVERSATIONacme/payments-api
How do we validate user sessions?

Sessions are validated in verifySession(), which checks the signed cookie, then loads the user. Tokens are rotated on every privileged action, and expired sessions are rejected before any route handler runs.

src/auth/session.ts#L41-L58src/middleware/guard.ts#L12-L30src/auth/rotate.ts#L7-L22

SAFETY BY DESIGN

Two-phase write approval keeps a human on every change, and pull request content is quarantined so it can never instruct the model.

01

Propose

The reviewer drafts a fix as a diff. Nothing touches your repository yet.

02

Inspect

You see the exact patch, the finding it resolves and the evidence behind it.

03

Approve

A one-time 64-character nonce authorises exactly this change, once.

DASHBOARD

Trends, severity and pillar coverage in one place. The figures below are sample data.

Reviews per day

58 +31%

SAMPLE

Findings by pillar

PRICING

FREE
$0/ month
  • Up to 3 connected repositories
  • 25 pull request reviews / month
  • 100 codebase Q&A queries / month
  • All 5 engineering pillars
  • Two-phase safe write approvals
Start free
PROMost popular
$39/ month
  • Up to 15 connected repositories
  • 250 pull request reviews / month
  • 2,500 codebase Q&A queries / month
  • Custom review rules & team guidelines
  • Priority background worker queues
Choose Pro
TEAM
$149/ month
  • Up to 50 connected repositories
  • 1,000 reviews / month
  • 10,000 codebase Q&A queries / month
  • Dedicated Slack / webhook integrations
  • Personalized 24/7 priority support
Choose Team

FAQ

ReviewFlow AI connects via an official GitHub App with least-privilege permissions (Read Pull Requests, Write Check Runs and inline comments). There is no need to share personal access tokens or grant full repository write permissions. Installation takes under two minutes for personal accounts or organizations.

Connect a repository in minutes and get your first cited review today.

Start freeRead the docs