Patchlight
Start free

Reviews every pull request and commit, and keeps a scheduled security monitor on your repositories. GitHub-native, pay only for what you use.

Start free — 20 PR reviewsSee how it works

2-click install · no credit card · never trained on your code

acme/payments-apisecurity monitor · scanning
Findings7
  • criticalCWE-89

    Search filter concatenates q directly into SQL

    src/api/users.ts:214

  • highCWE-798

    Live database password committed in plaintext

    scripts/seed-db.ts:19

  • mediumCWE-918

    Issuer URL is fetched without host allow-listing

    src/auth/oidc-discovery.ts:88

+ 4 more in the dashboard

0files walked0candidates sent0findingsevery 24h

Features

Eight things it runs today, in the order you meet them.

The Patchlight scanner findings table: 23 open findings with severity, CWE and file location.
01

Security monitor

The whole repository, not just the diff

On a schedule or on demand, Patchlight walks every file in the repo, sends only what looks risky to the model, and reports findings it can point at: severity, CWE, exact file and line. They land in one triage table and stay there until they're resolved.

  • Nightly scans per repository — you choose which ones
  • Every finding carries a CWE and a file:line you can open
  • Filter by severity, scope or repo; resolve as you fix
02

PR review

A senior reviewer on every pull request

Each pull request — and every push to it, if you want — is read for correctness, security and maintainability. Findings that come with a fix are posted as inline GitHub suggestions you can commit in one click; the rest go into a summary comment that opens with what the PR actually does.

  • Suggestions anchored to the exact lines they fix, committable from the PR
  • Severity and category on every finding: security, bug, performance, style, maintainability, convention
  • Everything also lands in the dashboard, so nothing is lost when the PR closes
src/api/users.ts+12 −4
16export async function getUser(ctx, id) {
17 const user = await db.users.find(id);
17 const user = await requireOwner(ctx, id);
18 return serialize(user);
patchlightbotcommented on this line

🟠HIGH · security: Any caller can read any user by id

db.users.find(id) is not scoped to the requester, so a guessed id returns another tenant's record. Go through the ownership guard.

Suggested change

− const user = await db.users.find(id);
+ const user = await requireOwner(ctx, id);
Commit suggestionAdd to batch
03

Reverse task check

Did the PR do what the ticket asked?

After a merge, Patchlight finds the Linear issue behind the PR — from the branch name, the title and body, or Linear's own PR attachments — and reads both sides: what the issue described, and what the diff actually shipped. The report goes back on the issue.

  • Flags logic that differs, constants that don't match, scope that never landed — and scope nobody asked for
  • Optional testing notes for QA: scope of change, risks, what to try
  • Runs on merge, or on “@patchlight task-check” in a comment
APP-214 · Rate-limit password resetsmerged · 12s ago
Discrepancies foundposted on the issue

The endpoint is limited, but not the way the issue describes — and the notification half of the ticket never shipped.

  • constant differs—implemented as 10 attempts / 15 min; the issue says 5 per hour
  • scope missing—no email is sent when the limit trips

Testing notes

scope: auth service · reset-password endpoint · redis limiter

Verify the limit trips at attempt 11, not 6

Confirm the window resets after 15 minutes

Flag the missing email to the PM before release

04

Analytics

Where the findings actually come from

Reviews, findings, resolution rate and turnaround over any window, broken down by severity, category and repository — plus contributor activity: findings per PR, per thousand lines changed, and how much of it gets resolved.

  • 7, 30 or 90 days, filtered to one repository or the whole workspace
  • Resolution rate as the honest signal: not how much was flagged, but how much was fixed
Contributor activitylast 30 days
AuthorPRsResolved
mamaya3486%
dmdmytro2871%
sasasha1958%
rerenovate[bot]4693%

Findings by severity

By category

Security41Bugs33Maintainability18Convention8
05

Flexible triggers

You decide when it wakes up

A canvas of When → Only if → Then. Chain events, conditions and actions until the flow matches how your team actually ships — the graph you draw is exactly what runs.

  • Events: opened, reopened, every push, ready for review, merged, or an @patchlight comment
  • Conditions: base and head branch globs, changed paths, labels, authors, skip drafts, skip bots
  • Actions: start a review, run a task check — set workspace defaults, override per repository
When
PR reopened
Enabled
Only if
Target branch
Include branches
main
Exclude
wip/*
Then
Run task check
06

Team rules

Enforce your standards in plain English

Write the rules the way you'd tell a new teammate. The reviewer reads the intent, not just the keywords, and a violation comes back as a finding that quotes the rule it broke.

  • One list for the workspace, extended per repository
  • Violations arrive as convention findings — same triage, same dashboard
Review rulesworkspace
Never use lodash — prefer native array methods.
All API routes must validate input with zod.
New endpoints need a rate limit and an auth check.

21const emails = _.uniq(users.map((u) => u.email));

conventionpatchlight[bot]

Team rule violated: “Never use lodash — prefer native array methods.” Use [...new Set(users.map((u) => u.email))] instead.

07

Reports

A weekly read on the codebase

Weekly or monthly, Patchlight writes up the window: what moved, where findings clustered, whether the security posture is improving or degrading — and suggests rules drawn from what it kept flagging. Adopt one and it applies to the next review.

Mar 3 — Mar 9weekly

Review volume held steady while critical findings fell for the third week.

Reviews

63

+9%

Findings

148

−12%

Resolved

74%

+6 pts

Security posture: improving

Suggested rule: “Every new API route must check ownership before returning a record.”Adopt
08

Ask AI

Chat about your findings

A chat that queries your workspace instead of guessing. Which files collect the most findings, what's still open and critical, how the rate changed this month, what reviews have cost — answered from your own data, with the numbers attached.

Ask AIyour data only

What kinds of problems do we keep repeating?

Three patterns account for most of the last 90 days — all of them in request handlers:

  • Missing ownership / auth checks31 findings
  • Unvalidated input reaching a query24 findings
  • Unhandled promise rejections17 findings

Two of them are already covered by a rule; the third is not.

Ask about your findings…

How you run it

The same reviewer, three ways in — pick the one your team already lives in.

acme/payments-apiapp installed · 6 repos

  • pull_request.opened · #48212:04

    feat/rate-limit → main

  • Trigger matched12:04

    into main · not a draft · not a bot → start review

  • patchlight[bot] reviewed12:05

    2 inline suggestions · 1 finding in the summary

  • “@patchlight review”14:22

    re-reviewed after 3 new commits

Privacy

The beam passes through your diff and the room is exactly as you left it. We keep the finding — a file, a line, and the fix. Not the code it came from.

Privacy policyTerms

Read

export async function searchCustomers(req) {
- const rows = await db.query(safe(q));
+ const rows = await db.raw(
+ `SELECT * FROM customers WHERE name LIKE '%${q}%'`
+ );

released when the review ends

Kept

auth.ts:214

SQL injection via interpolated query

+ db.query(sql, [q])

Dropped

  • the diff
  • the file contents
  • the prompt
  • the model's transcript

No training

On your code. Ours or a provider's.

Zero retention

Nothing persisted at the model.

EU-operated

GDPR-ready, DPA on request.

Pricing

Free

$0

Your first 20 reviews or scans, on us

  • PR review
  • Security scan
  • Findings dashboard
  • Analytics
Start free
Popular

Pay as you go

from $10

Prepaid balance, no subscription

  • Everything from the Free tier
  • Usage-based pricing
  • Weekly reports
  • Ask AI chat on your findings
  • Linear reverse task check
  • Team rules & flexible triggers
  • Priority models
Add funds

Compare

Review, security monitoring, reports, and task checks — billed for usage, not seats.

PR reviews with inline comments

Patchlight
CodeRabbit
cubic

Full-repo security monitor

Scheduled or on-demand scans beyond the PR diff

Patchlight
CodeRabbit~
cubic~

Findings analytics & reports

Dashboards plus weekly/monthly write-ups

Patchlight
CodeRabbit
cubic

Ask AI on your findings

Chat grounded in your workspace data

Patchlight
CodeRabbit
cubic

Linear reverse task check

Did the merged PR match the ticket?

Patchlight
CodeRabbit~
cubic

Team rules in plain English

Patchlight
CodeRabbit
cubic~

Pricing model

PatchlightPay as you go, from $10
CodeRabbitFrom $24/user/mo
cubicFrom $30/dev/mo

Usage caps

PatchlightNone — pay per use
CodeRabbitReviews/hour by plan
cubic40–80k lines/dev/mo

Free to start

Patchlight20 free reviews/scans, no card
CodeRabbitSummaries + Pro trial
cubic20 PRs/mo

✓ included · ~ partial or add-on · — not offered. Based on public docs and pricing pages, August 2026. Spotted something off? Tell us and we’ll fix it.

Blog

Read the Patchlight blog

Two minutes to install. Your first review lands on the next push.

20 free reviews or scans · no card