AI pull-request reviews
Context-aware summaries, inline comments and an approve / request-changes verdict on every PR.
move your cursor — watch the related files gather
// how it works
From push to review, in one pass.
No pipeline to rewrite, no config to commit. Connect a repository and this runs on every pull request.
A pull request is opened on your git platform.
- Summary
- Inline findings
- Committable fixes
- Verdict + gates
// live review
See the review land on your PR.
The moment a PR opens, ReviewIQ scans the diff, flags the exact vulnerable line with a severity and CWE, and posts a one-click committable fix — then sets the merge verdict.
app.reviewiq.site/growth99/api/pulls/128
#128 · Add rate limiting to /login● Reviewing…
app/core/config.py+3 −1
9
import boto3, os10
11
def s3_client():−
return boto3.client("s3")12+
key = "AKIA5X7EXAMPLE9QID2"13+
secret = "wJalrXUtnFEMI/K7MDENG/EXAMPLEKEY"14+
return boto3.client("s3", key, secret)15
Hard-coded AWS credentials
A live AWS access key is committed to source — anyone with repo read access can use it. Load it from an environment variable or your secrets manager instead.
Suggested change
- key = "AKIA5X7EXAMPLE9QID2" + key = os.environ["AWS_ACCESS_KEY_ID"]
✓ Commit suggestionDismiss
Works where your code already lives
GitHubGitLabBitbucketAzure DevOpsJiraSlack
Capabilities
Everything a senior reviewer does — on every pull request.
Not a linter bolted onto a webhook. A reviewer that understands the change, the codebase around it, and what your team cares about.
Committable suggestions
One-click, apply-ready fixes posted straight onto the diff — the feature developers actually use.
PR chat & Q&A
Ask anything about the change and get answers grounded in the diff and the surrounding files.
Incremental reviews
Re-reviews only the newly changed lines when you push follow-up commits. No re-litigating.
Ticket compliance
Scores each PR Fully / Partially / Not compliant against its linked Jira issue — a rival-beating check.
Custom rules & gates
Steer the reviewer with your own prompts and policies, and block merges on quality or security gates.
// the difference
Bugs a single-file linter can't see.
Pick a real defect class. Watch ReviewIQ trace the tainted value across files, then hand back a committable fix.
CriticalCWE-639cross-file finding
auth.controller.ts→
session.guard.ts→
db.pool.ts
Why a single-file linter misses it: The controller trusts an x-tenant-id header that only becomes dangerous three files later, where it is concatenated into a tenant-scoped query. No single file looks wrong on its own.
before
// session.guard.ts — forwards header verbatim
const tenantId = req.headers['x-tenant-id'];
return ctx.forward({ tenantId });committable fix
// session.guard.ts — bind tenant to the verified JWT claim
const { tenantId } = verifyJwt(req).claims;
return ctx.forward({ tenantId });// cross-file tracer
It reads your repo as a graph, not a text file.
A tainted header enters one file and surfaces as a vulnerability three files away. Hover any node to see its neighbourhood; the trace plays on its own.
ReviewIQ maps the files this pull request touches.
// pr chat & q&a
Ask your pull request anything.
Not sure why something was flagged, or whether it's safe to merge? Just ask. ReviewIQ answers in seconds — grounded in the diff, the files around it, and the review it already ran.
#128 · Add rate limiting to /loginfeature/login-throttle → main
Ask anything about this PR…Ask ReviewIQ →
Security, built in
Eight analyzers scan every diff — no extra tool to buy.
Security and code-quality analysis run alongside the AI review on the same pull request, then feed merge-blocking gates. One platform, one signal.
◆ Inline findings on the exact vulnerable line, with CWE + severity◆ Merge-blocking security & quality gates◆ CycloneDX SBOM & findings export
SASTSemgrep + CWE rules
Secretskeys, tokens, creds
DependenciesOSV / SCA
IaCTerraform · K8s
Cloud misconfigAWS · GCP · Azure
Complexityhotspot detection
Duplicationcopy-paste debt
Dead codeunused paths
8Built-in analyzers
4Git platforms
30+CWE-tagged rules
100%of PRs auto-reviewed
Ship faster, merge safer.
Connect a repository and ReviewIQ reviews your next pull request in minutes — free to start.