I Built an AI Code Reviewer That Caught 29 Issues (8 Critical) on Its First Real PR

#ai #automation #security #showdev

I got tired of reviewing PRs and finding the same issues over and over — hardcoded secrets, eval() calls, debugger statements left in, missing error handling, SQL injection vectors. The kind of stuff that shouldn't reach production but always does.

So I built VetBot — an AI agent that reviews every pull request for production-readiness issues.

What it checks:

🔒 Security — hardcoded secrets, eval(), SQL injection, XSS
⚠️ Error handling — empty catch blocks, unhandled promises, missing try/catch
📝 Logging — sensitive data in logs, missing context
🚀 Deployment risks — debugger statements, process.exit(), hardcoded localhost
🎯 Edge cases — parseInt without radix, null checks
I ran it on a test PR with intentional issues and it found:

29 total findings
8 critical (blocked merge)
13 warnings
5 categories covered
It doesn't just flag issues — it suggests the exact fix code for each one.

Stack: TypeScript, Hono, Octokit, OpenAI-compatible LLM, dual-mode (rule-based + AI)

Pricing: $49/mo (Starter) → $149/mo (Team) → $399/mo (Scale)

Check it out: https://site-evkdm0zl9-subzero4.vercel.app

Would love feedback from the dev community!