Buggers · Automated PR Code Review

Buggers — Catch critical issues
before they reach production

Buggers automatically reviews your pull requests, detects bugs, security risks, and code quality issues — so you can ship with confidence.

Get Started See How it Works

CODE REVIEW & REGRESSION PROTECTION

Deterministic PR triage with whole-repo context

Buggers inspects the raw unified diff against historical fault lines. In-process scanners catch side-channel timing flaws, plaintext secrets, and SQL injections in 140ms before synthesising AST-grounded patches.

Explore triage architecture

Automated Diff Scanner & Remediation Simulation

src/auth/session.ts

Scanning AST hunks...

05import { createHmac, timingSafeEqual } from 'crypto';

07export function verifySessionToken(token: string, session: Session) {

08 if (token === session.signature) {

09 return true;

10 }

11}

PR #184·Session Timing Leak

HIGH RISK

Calculated Composite Risk:78 / 100

In-Process AST Scanner Active

Inspecting syntax tree nodes and regex boundaries before invoking LLM fallbacks...

9-Stage Deterministic Pipeline

Repository Churn & Volatility Metrics

P95 Confidence: 99.4%

Test Coverage Delta

−14.2%

Critical paths left uncovered

Cyclomatic Complexity

+8 Delta

Nested conditional branches

paymentValidator.ts

Top 5% volatile in repo (12 defect rollbacks)

stripeGateway.ts

Clean ownership pattern (98% author overlap)

Risk Score Evaluation:82 / 100 (HIGH REGRESSION RISK)

INTELLIGENCE & VOLATILITY ENGINE

Eliminate phantom alerts with AST-level signals

Generic LLM wrappers hallucinate phantom line numbers and suggest libraries you don't even have installed. Buggers correlates modified functions with your real git commit history, defect frequency, and coverage deltas to score real regression risk.

Explore risk methodology in Docs

CI / CD & MERGE GATES

Enforce quality gates with declarative repository rules

Define review thresholds with a simple .buggers.yml in your repository root. Set GitHub check runs to automatically block pull request merges when critical severity findings or high risk are detected.

View .buggers.yml configuration reference

.buggers.yml

Repository Root Config

version: 1
risk:
  threshold: 75             # Maximum allowable risk score
  fail_on_critical: true     # Block merge if critical finding exists
  block_on_secrets: true     # Fail check if hardcoded secrets found
ignore:
  paths:
    - "docs/**"
    - "**/*.spec.ts"

GitHub Check: Buggers Risk Gate

Risk 82 exceeds threshold 75 · Merge Blocked

Required Check

FIG 0.1

Instant Webhook

PR openings and pushes trigger AST evaluation via HMAC-verified webhooks without poll delays.

FIG 0.2

Commit Churn

Correlates changed functions with past rollback commits and defect density in that file.

FIG 0.3

Risk Scoring

Deterministic 0-100 score weighing cyclomatic complexity, test delta, and mutation paths.

FIG 0.4

Grounded Fixes

AI remediations cite real diff line numbers only. Hallucinated file paths are discarded.

Official Extension · v1.2.0 Stable

Debug, remediate, and secure
directly in your IDE

Don't wait for remote CI queues. The Buggers VS Code extension scans modified files in real time, displays side-by-side diff previews in an interactive Webview Flaw Inspector, and intercepts vulnerable git commits.

Read technical extension specification

Buggers for VS CodeRelease 1.2.0 · Standalone VSIX

73.6 KB

Package includes offline AST scanner, 21 OWASP vulnerability categories, 7 credential regex formats, 5 logical bug detectors, and consent-gated AI assistant.

1-Click Terminal Command

code --install-extension buggers-vscode-1.2.0.vsix

Download Extension .VSIX (v1.2.0)

VS Code·Cursor·Antigravity IDE·VSCodium

auth-handler.ts

● Live Local Diagnostics Active

Buggers CodeLens:1 Critical Flaw Detected (CWE-208 Timing Attack)·Inspect in Webview·1-Click Auto-Fix

// Validate signature token with constant-time equality

export function verifyToken(clientToken: string): boolean {

- return clientToken === process.env.API_SECRET;CWE-208

+ return crypto.timingSafeEqual(Buffer.from(clientToken), secretBuf);Safe Auto-Fix

}

0 Cloud LeakLocal AST AST

21 CategoriesOWASP Top 10

Pre-CommitGit Hook Shield

AI Fix DiffsConsent Gated

Ready in Visual Studio Code ExtensionsDownload v1.2.0

Ready to review pull requests with ease?

Connect your GitHub repository once. Buggers runs non-blocking checks on your next pull request.