Blog
Practical guides on AI code review, choosing models per pull request, and keeping LLM spend predictable, for engineering leaders and the teams they run.
Three AI code reviewers, three ways to charge: Macroscope meters kilobytes of diff, CodeRabbit sells developer seats, Greptile sells review credits. What each one actually posts on a pull request, what a 5, 20 and 50 developer team pays per month, and the fine print that moves the number.
Read article
A config change has no tests, no types and a one-line diff, which is why it causes the outage nobody can reproduce locally. The eight questions a reviewer must ask of any PR that touches an env file, a settings module, a compose file or a Helm values file, what an AI reviewer can verify from the repository, and the rules that ask them every time.
Read article
Logging writes to the system with the widest audience and the least review. The eight questions a reviewer must ask of any PR that touches a logger, a metric, a span or an alert rule, why a diff-only reviewer answers few of them, and the rules that make them run every time.
Read article
Every cache is a correctness bug waiting for the input you forgot to put in the key. The seven questions a reviewer must ask of any PR that adds a cache, why a diff-only reviewer answers none of them, and the rules that make them run on every one.
Read article
Money bugs do not throw; they reconcile badly a month later. The seven mechanical defects a reviewer can catch in the diff, the five that need project rules, and the rule set to make both run on every PR that touches money.
Read article
The one-line version bump nobody reviews ships to every environment at once. The seven questions a reviewer must ask about a Dockerfile, why a diff-only reviewer cannot answer them, and how to make them run on every image PR.
Read article
A flag PR is a one-line boolean change whose bug lives in a config file that did not change. The seven questions a reviewer must ask, why a diff-only reviewer cannot, and how to make them run on every flag change.
Read article
The catch block is the part of the pull request nobody reads, and the part that decides what the outage looks like. Ten questions a reviewer should ask about every error path, why humans skim them, and how to make an AI reviewer ask them on every PR.
Read article
Broken access control tops the OWASP list because it hides in what a diff leaves out. Here is how to make a reviewer look for the absence.
Read article
Race conditions pass every test and every line-by-line review, because the bug is between the lines. The seven shapes a reviewer should pattern-match, the review instructions that make an AI reviewer find them, and why repository context is the difference between a guess and a finding.
Read article
A renamed field is correct, tested and green inside its own repository, and breaks a consumer nobody in the PR can see. What counts as breaking, the seven questions a reviewer must ask, what a model can verify from the repository, and how to make it run on every interface change.
Read article
Performance bugs are correct code that is merely slow, which is why they sail through review. The six patterns an AI reviewer can catch on every PR, the measurements it cannot make, and the rules that keep the comments useful.
Read article
Nobody reads the test files in a pull request, which is how tests that cannot fail get merged. The eight questions a reviewer should ask of every new or changed test, and how to make an AI reviewer ask them on every PR.
Read article
Workflow YAML is the one place a few characters can hand a stranger your deploy credentials, and it gets the least review of anything in the repo. The seven questions a reviewer must ask, why a diff-only reviewer cannot, and how to make them run on every workflow PR.
Read article
The question every BYOK team asks in a planning meeting, and why the answer is a routing rule rather than a brand. The dimensions that differ in practice, a two-week comparison method for your own pull requests, and the budgets that keep the result honest.
Read article
One is a line item on a subscription you may already have and now meters every review twice. The other is a full review platform priced per developer. How they review, what they cost after June 2026, and the three things neither gives you.
Read article
One indexes your whole codebase and bills by seat plus credits; the other packages the entire review and bills by developer with hourly limits. What each is best at, what a ten-person team actually pays, and the question neither of them answers.
Read article
The only reproducible security benchmark vendors cite was built for SAST, in one language, from CVEs every model has read. The method still transfers; the number does not.
Read article
A migration ships once, runs on data the author never saw, and locks tables nobody measured. The seven questions a reviewer must ask, why a diff-only reviewer cannot, and how to make them run on every migration PR.
Read article
There is no cap on total reviews. There is a per-developer hourly allowance, and a seven-day counter that quietly slows it down.
Read article
The four-thousand-line PR that two people approved without reading. What AI review can genuinely do about it, and why the diff size is usually the finding.
Read article
Your security team says the code stays inside. The vendor says the self-hosted tier starts at 500 seats. Here is what is actually available in between.
Read article
Every AI reviewer looks good in week one. Here is how to find out what month three will be like.
Read article
The four tiers, who counts as a billable seat, the hourly limits nobody reads, and how to work out what you will actually pay.
Read article
A version bump is a two-line diff sitting on top of an arbitrarily large change that is not in the diff at all. That mismatch is the whole problem.
Read article
Policy scanners answer rule-shaped questions well. The changes that actually hurt are the ones where two correct resources combine into something that is not.
Read article
The four current tiers, what per-developer billing really counts, and the limits that only show up on your busiest day
Read article
A thread of bot comments proves nothing. What auditors actually ask for, and the "log everything" habit that turns evidence into a finding
Read article
Open source, source-available and self-hosted are three different promises that get bundled into one search term — what an OSS licence genuinely buys you in AI code review, and what it quietly does not.
Read article
Integration model, merge enforcement and comment threading all differ outside GitHub - and the self-managed question is usually the one that decides your shortlist.
Read article
The open-source and free options that can stand in for CodeRabbit, what each really costs to run, and the gap the listicles will not mention
Read article
Per-seat, per-review, credits, and BYOK - the four pricing models, what they hide, and when self-hosting wins the math.
Read article
The data-flow questions that decide whether an AI reviewer belongs anywhere near your repository
Read article
Every channel your AI reviewer reads — descriptions, commits, comments, diffs — is text an attacker can write. Why prompt injection is a structural risk for review pipelines, what real attacks look like, and the five controls that keep influence from becoming impact.
Read article
One is a precision bug hunter living inside the Cursor platform. The other is the most installed review platform on GitHub. They overlap far less than their marketing suggests.
Read article
An AI reviewer ships knowing general best practice. It does not know your team decided repositories never call HTTP clients directly. Custom rules are how it learns — if you write them like specs, not vibes.
Read article
Big companies have review queues. Small teams have one overloaded colleague. The case for AI review is strongest where every interruption costs a meaningful share of total output.
Read article
Feature branches are outrunning main. The constraint moved from writing code to deciding whether code is safe to merge — and most teams have not caught up.
Read article
Five credible alternatives compared on the three axes that actually drive the switch: pricing model, self-hosting, and control
Read article
On known vulnerability patterns, good tools now catch a solid majority. On real runtime bugs, independent evaluations show even the leaders miss more than half. What the public benchmarks actually say, why the numbers spread so widely, and how to measure accuracy on your own repository.
Read article
Make the AI reviewer a required check, and every false positive becomes an incident. Keep it advisory, and its best findings get scrolled past on deadline weeks. The severity-split model that avoids both failure modes, and a staged path to get there.
Read article
The unit of review is the diff, but the unit of correctness is the system. Where diff-only AI review breaks down, how modern tools pull in repository context, and why review depth should be a routing decision rather than a global setting.
Read article
SQL injection, XSS, command injection — the vulnerability class that never dies. An honest look at what AI code review catches that scanners miss, where it still fails, and how to layer both.
Read article
Teams rarely abandon AI code review because it missed bugs - they abandon it because it was noisy. Where false positives actually come from, the configuration knobs that eliminate them, and the two numbers that tell you whether your reviewer has earned its place on the PR.
Read article
Monorepos break diff-only reviewers: blast radius lives outside the diff, standards vary by directory, and ownership follows paths. What good monorepo review requires and how to configure PURA for it.
Read article
Coding agents now take a ticket and open the pull request themselves - which makes review the first human contact with the code. The four policy decisions that make agent-authored PRs safe to merge, the failure modes to review for, and how to keep the queue and the bill under control.
Read articleAI review catches a class of security bugs that rule-based scanners fumble — and misses a class no PR reviewer can see. Where the boundary sits, how to configure the security layer so it works, and why the reviewer's own deployment model is a security finding.
Read article
A GitHub Action plus an LLM API makes a convincing AI reviewer in an afternoon — which is exactly why the build-vs-buy debate goes wrong. What separates the demo from a production review system, the accounting error that makes building look free, and the four questions that settle the decision.
Read article
Comment counts and “PRs reviewed” dashboards say nothing about whether an AI reviewer is earning its keep. Here are the five metrics that do — signal quality, time-to-merge, escaped defects, reviewer load, and cost per acted-on finding — and how to instrument each one.
Read article
Most AI code review rollouts fail socially, not technically — noisy first impressions, unclear rules, and reviewers who feel policed. Here is a four-week plan that gets a team from skeptical to reliant, with the config decisions spelled out.
Read article
AI assistants made writing code cheap — and quietly made verifying it the most expensive step in your pipeline. Why review is the 2026 bottleneck, the three ways teams get it wrong, and how to build a review system that scales with AI-era PR volume.
Read article
Why teams keep source code on their own infrastructure — the security, compliance, and cost case for self-hosted and single-tenant AI code review, and how to run it without a multi-week DevOps project.
Read article
Per-seat bills that grow with headcount, hourly review limits, and no say in which model reads your code — the CodeRabbit problems teams hit at scale, and how PURA fixes each one.
Read article
Why bring-your-own-key beats per-seat billing for AI code review — and how to keep the resulting API spend under control.
Read article
Give every repo its own review allowance — production services get premium, internal tools stay lean.
Read article
Let the team that owns the code decide how thoroughly it gets reviewed — and how much to spend doing it.
Read article
Distribute review spend by contributing team so no single squad burns through everyone's allocation.
Read article
Run Claude where it matters, Gemini where it doesn't — and never pay premium for dependency bumps again.
Read article
Stop runaway LLM costs by giving every contributor their own review budget — without slowing anyone down.
Read articleSuggest a topic
We write about AI code review budgets, routing and engineering leadership. Tell us what you'd like to read next.
Suggest a topic