AI wrote it. Who reviewed it?

AI code ships fast. So do the holes. CodeCorvus checks every pull request before the merge and shows you what doesn't make sense, what leaks and what breaks.

Check my next PR Show me what it catches

It compiles. Tests pass. And it's full of holes.

AI writes in minutes what used to take a day. What comes with it, nobody has time to read. Happens to everyone.

Committed secret

src/billing/client.ts+3−0

@@ -12,1 +12,4 @@

1212import Stripe from "stripe";

13const stripe = new Stripe("sk_live_••••••••");

codecorvusbot· nowblocking

A production key in the code. Gitleaks blocks it on the spot, and the value is redacted from the comment.

14export const charge = (amount: number) =>

15 stripe.charges.create({ amount });

Patient data in the logs

src/report.js+1−1

@@ -41,3 +41,3 @@

4141} catch (error) {

42 logger.error("export failed", error.message);

42 logger.error("export failed", payload.patient);

codecorvusbot· nowblocking

payload.patient sends name and national ID to the logs. Log only the report id.

validated

4343 throw error;

Compiles, but wrong

src/api/orders.ts+2−0

@@ -27,2 +27,4 @@

2727const size = 20;

28const start = (page - 1) * size;

29return orders.slice(start, size);

codecorvusbot· nowimportant

slice takes where to stop, not how many items. From page 2 on, the list comes back empty.

2830}

Business rule ignored

src/plans/discount.ts+1−1

@@ -8,3 +8,3 @@

88export function seniorDiscount(age: number) {

9 return age >= 60 ? 0.3 : 0;

9 return age > 60 ? 0.3 : 0;

codecorvusbot· nowimportant

The repo's rule says “60 and over”. With >, people who are exactly 60 lose the discount.

1010}

PR #517 · Refactor billing · 47 files

A giant PR nobody reads carefully.

Corvus reads every line and only speaks up when it matters.

Corvus review

corvus -b main

Reviewed · 46s · step 12

1blocking
2important
3suggestions

Merge blocked: 1 serious issue, confirmed.

Reviews line by line. Blocks only what's critical.

Reads the whole diff

Every file in the PR, with the repo's context. The comment lands right on the line with the problem.

Explains it and suggests the fix

Tells you why it's a problem and hands you the fix as a Commit suggestion. One click, done.

Blocks only what's critical

Blocking holds the merge. Important just warns. A suggestion is just a suggestion, no pressure.

Inline comments, a severity scoreboard and a badge from the AI that tried to refute the finding.

github.com/acme/clinic-portal/pull/482

Improve report export #482

Openacme-dev wants to merge 3 commits into main from feature/report-export

Conversation4Commits3Checks3Files changed4

codecorvus bot reviewed these changes · 2 min ago

CodeCorvus review

🔴 1 blocking·🟡 2 important·🔵 3 suggestions

4 files reviewed. 1 blocking finding survived adversarial validation.

src/report.js

41	41		} catch (error) {
42		-	logger.error("export failed", error.message);
	42	+	logger.error("export failed", payload.patient);
43	43		throw error;

codecorvus bot · 2 min ago

🔴 Patient data may end up in the logs

payload.patient includes name and national ID. Log only the report identifier.

validatedA second AI tried to refute it and couldn't.

Suggested change

42		-	logger.error("export failed", payload.patient);
	42	+	logger.error("export failed", { report: payload.id });

Commit suggestion

To release with a reason: /corvus ok or /corvus fp

Merging is blocked

1 blocking finding must be fixed or released with a reason.

CodeCorvus: findings

src/report.js2

Patient data may end up in the logs43

Move the date format into a constant12

src/api/patients.ts2

Unpaginated query can exhaust memory88

Variable name isn't descriptive40

src/jobs/sync.ts2

Error swallowed in catch31

Prefer async/await over chained then9

report.jspatients.ts

srcreport.js

36import { logger } from "./logger.js";

38export async function exportReport(payload) {

39 const rows = await fetchRows(payload.id);

40 try {

41 return await renderPdf(rows, DATE_FORMAT);

42 } catch (error) {

43 logger.error("export failed", payload.patient);

🔴 Patient data may end up in the logs

payload.patient includes name and national ID. Log only the report identifier.

validated

Fix with CorvusRelease with reason

44 throw error;

45 }

46}

48export function formatDate(date) {

49 return format(date, "dd/MM/yyyy");

50}

feature/report-exportCodeCorvus: reviewing feature/report-export123

Doesn't block for nothing. Another AI checks first.

Before blocking, another AI hunts for a hole in the finding. Found one? No block. Didn't? It gets the “validated” badge and holds the merge.

Try the gate

Flip the switches. The merge changes instantly.

Is there a secret in the diff?

Is the finding critical?

Did the second AI knock it down?

Disagree? Drop a /corvus fp with the reason and move on. It's on the record.

FindingCritical finding
ChallengeTried to knock it down and couldn't

Merge blocked

validated

The finding gets the “validated” badge, and the suggested fix lands on the line.

The scoreboard is public. Proof it reviewed.

Every release, Corvus runs against a golden set of real and planted cases, and the results go public. This one's from the Grupo Mais Saúde case.

golden set · 13 cases

100%recall on blocking findingscaught every critical problem
100%precision on blocking findingsevery block was a real problem
0false positives blocking a mergeno PR held for nothing

Results for this 13-case golden set; not a guarantee for every repository.

Start on your next PR. Your flow stays the same.

.github/workflows/corvus.ymlYAML

1name: CodeCorvus2on: [pull_request]34permissions:5  contents: read6  pull-requests: write7  id-token: write   # short-lived OIDC session89jobs:10  review:11    runs-on: ubuntu-latest12    steps:13      - uses: actions/checkout@v414      - run: corvus review

Reviews every PR on your runner.

terminal

$ corvus -b main⠹ 46s · step 12 · Reading src/report.js1blocking2important3suggestions

Run it before you open the PR and watch it go.

Problems · VS Code · Cursor

Patient data in the logssrc/report.js:42
Compiles, but wrongsrc/api/orders.ts:29
Business rule ignoredsrc/plans/discount.ts:9

Findings pop up in your editor. In the PR, just ask: /corvus explica.

Illustrative example. Install and configure the CLI for your CI environment.

Cloud · coming soonThe same Corvus, no AI key and a dashboard.

Your code, in your CI. Your key, out of the repo.

Runs on your runnerThe workflow runs in your GitHub Actions. Code goes from the runner straight to the AI provider.
No key in the repoA short-lived session via GitHub OIDC. No secrets sitting in the repo. Period.
The AI only reads codeIt reviews the diff and its context. It doesn't run commands or reach the network.
Secrets always redactedDeterministic Gitleaks, and Semgrep confirmed by the AI.
Built for LGPDRules for Brazilian IDs and patient data in logs, payloads and responses.

Quick answers.

What is CodeCorvus?

An open source AI code reviewer that runs in GitHub Actions. It reads every pull request, comments on the line with the fix, and only blocks the merge for a critical problem that a second AI couldn't knock down.

How much does it cost?

Open source is free: bring your own AI key, or your subscription in the CLI. Cloud has no price yet; it's coming soon.

Where does my code go?

The workflow runs on your GitHub Actions runner. Code goes from there straight to the AI provider you pick.

Will it block my merge for nothing?

Nope. Only a critical finding holds the merge, and only after another AI tries to knock it down. Disagree? /corvus ok or /corvus fp, with the reason, and move on.

Does it work with GitLab?

Not for now. The CI integration targets GitHub Actions and GitHub pull requests.

Does it help with LGPD?

Corvus ships rules for Brazilian IDs and patient data in logs, payloads and responses, and records review evidence. It doesn't replace legal advice.

What are you waiting for?

One workflow, one PR, done: Corvus is already reviewing.

Go on, install it

Open source and free. No sign-up, no catch.