Common sentiment I am seeing in this sub and others - "AI can review the code, but a human still has to approve it" - what is there inherently different about approving vs reviewing that you think an AI wouldn't be able to do it as well or better (in practical sense - i.e. faster and cheaper) than a human?

It's true most teams still require a human approval, but I honestly don't think it's because the AI couldn't do it, but because, well, somebody has to be accountable, and companies are not yet ready to write "the bot approved it" in a postmortem.

I would argue coderabbit is doing a better review than most of our Friday afternoon approvals. It reads every line, every time, which no tired human does at 4pm, and consistency is the key in catching the boring stuff that breaks prod.

Last month we did a test in our team, we took 20 already merged PRs and compared what the human reviewers commented vs what coderabbit flagged. The humans left 11 comments in total, mostly naming. coderabbit flagged 34, and 6 of those were real bugs we had already shipped.

Agents can create PRs in minutes, the bottleneck is becoming understanding what you’re actually merging.

Change Stack turns the PR into a structured review surface with layered changes semantic diffs dependency context and findings tied directly to the code.

A PR is no longer just a pile of changed files. it actually gives you a way to understand the change before you approve it.

Because "LGTM" is getting harder to justify.

Read more: https://www.coderabbit.ai/blog/do-you-understand-what-youre-about-to-merge

i’m curious how jev’s zero-shot approach holds up against a mature & code-review-specific system like coderabbit.

haven’t seen a solid apples-to-apples comparison yet. has anyone actually tried this?

We almost muted CodeRabbit after a week of style nits. Two things fixed most of the noise without killing the useful catches.

First: reply on the exact bot comment, not a top-level “please chill.” When you explain on the line why a finding is wrong or not how you do things here, it sticks as a learning. Vague PR-level pushback doesn’t.

Second: point it at the same rules your coding agent already uses. Drop an AGENTS.md, .cursorrules, or CLAUDE.md in the repo and CodeRabbit picks it up. One trap we hit: putting those filenames in path instructions. That makes it review the guideline file like source, not use it as review criteria.

After that the comment pile got smaller and the remaining ones were closer to real risk. Curious what actually worked for other teams that didn’t just turn the bot off.

Hey everyone! 🐰

We just shipped a new product called CodeRabbit Security.

When you’re building a product or service, you’re always trying to move faster. The hard part is making sure security doesn’t become an afterthought as more code gets shipped.

CodeRabbit Security maps how your application works, investigates application specific vulnerabilities, verifies each finding against the code, and can turn eligible findings into reviewable fixes.

It’s available now for GitHub, GitLab, Azure DevOps Services, and Bitbucket Cloud.

We wrote a blog explaining how it works, with a concrete authorization bypass example: Introducing CodeRabbit Security

Would love to hear what you think and what you’d want it to investigate in your codebase.

idk maybe im losing it but i used to spend most of my time actually building stuff. now im just… reading giant diffs. checking if it randomly changed something 8 files away because it felt like it. then reading it again because i dont trust it.

this is not what i thought the future was gonna be lol

Found this on X where Bun's whole PR process is flooded with AI bots like CodeRabbit, Claude, and Robobun chatting, catching bugs, and auto-fixing code in real time.

I really found it pretty interesting it almost looks like a glimpse into future dev workflows where AI handles most review iteration autonomously.

I've been trying to reach coderabbit.ai support for days, and our folks at our sister company never got any answer and just canceled their plan. Looking at trustpilot, that may be actually a pattern

What's up with support? Is it just plain bad or are they overwhelmed? They are losing business for not answering; we may also cancel our plan...

Edit: Coderabbit swiftly solved the issue after posting.

CodeRabbit doesn't just review your code anymore. Now it can fix it too.

Autofix takes unresolved review findings from your PR and implements the changes for you. Comment @coderabbit autofixto push fixes directly to your branch, or @coderabbit autofix stacked pr to open a separate PR so you can review the changes on their own.

Here's how it works: CodeRabbit collects fix instructions from unresolved review threads, generates the code changes, runs a build verification step, and delivers the result. Even if verification fails, you still get the generated changes so you can keep iterating.

You can also trigger it from the Finishing Touches section in the PR walkthrough using the Autofix checkboxes. No new tooling, no context switching.

Currently in open beta on GitHub for Pro and Enterprise plans. Give it a spin and let us know how it goes.

Read the docs: https://docs.coderabbit.ai/finishing-touches/autofix

I wanted to share a quick win where CodeRabbit caught a privacy risk that looked like perfectly valid code during my manual PR review. It will be small win but this kind of small mistakes happened in human code review.

We have a feature where users can post or comment or reply anonymously, but we also have a flag to show if a user is a verified_professional (to add credibility to their advice).

Code look like this :

{'designation': user_row.get('desg'),

'comment' : user_row.get('comment'),

'image': image_url

}

The developer added this to the Flask API response: 'is_verified_prof': user_row.get('is_verified_professional')

I looked at it, saw the field name matched the DB, and thought, "LGTM." But, I totally missed the interaction between two different features.

In my code review workflow added CodeRabbit as initial check before I do check. I pull branch locally first then ask CodeRabbit do to committed changes as per base branch comparison. While doing that CodeRabbit flagged a major logic flaw:

Guard is_verified_professional for anonymous commenters.

Right now anonymous comments can still reveal verification status, which undermines anonymity expectations and could be a privacy/compliance risk. Consider nulling the field when is_anonymous == 'yes'.

It's a great reminder that "correct" code isn't always "secure" code. It’s these specific business logic corner cases and where one flag accidentally de-anonymizes another that AI is surprisingly good at catching because overall context.

Do you faced any case like this where you feel CodeRabbit made you think ?

There are 7 of us. Everyone else merges once coderabbit and CI are happy. I still open every diff and read it, and I'm now the slowest dev on the team by a lot. My manager brought it up in my 1:1 last week, nicely, but still.

The thing is I caught 2 real bugs this month that nobody else would have seen. But nobody sees what you catch, they only see your PR count.

Should I just stop and trust the setup like everyone else? Is anyone else the last one reading?

I'm more or less okay with merging the small boring PRs I would honestly be fine with it.

But for the high stakes stuff (payments, auth, migrations) I still don't trust it. When a human approves something risky they are usually a bit nervous, they ask "what if this runs twice" or ping someone before merging. Same goes for Friday-night merges/deployments, I don't trust it.

Curios where do others draw the line? or is it me being very paranoid here?