criticalstore.ex:88
Tenant scope omitted in fallback query
The fallback reads every team's ledger entries for the period.
acme / reviews
Reviews every pull request. Keeps the findings. Forgets the code.
AI code review for GitHub and Bitbucket Cloud (Bitbucket on the Team plan, on demand), on your own OpenAI, Anthropic or Gemini key.
Start trial
Free · 14 days · 20 reviews
Review queue
sample data| PR | Change | State | Score |
|---|---|---|---|
| #482 | Protect tenant boundaries in ledger export acme/payments-api | queued | · |
| #479 | Idempotency keys on refunds acme/payments-api | completed | 88 |
| #61 | Move session store to Redis acme/identity · Bitbucket | completed | 91 |
| #475 | Parallelize nightly export acme/payments-api | failed · re-run | · |
Owners see the whole team. Engineers see the reviews they submitted.
acme/payments-api · PR #482 · feat/ledger-export → main
Protect tenant boundaries in ledger export
Findings 00 input tokens, est.
lowstore.ex:83
Empty-ledger path has no test
Only the happy path is covered.
mediumexport_worker.ex:40
Retry loop without backoff
A failing upload recurses immediately, forever.
Triage
Resolve or dismiss each finding. Every decision records who made it and when, and the report moves with it.
-
critical
Tenant scope omitted in fallback query
lib/payments/store.ex:88 · securityfallback_entries/1queriesEntryby period only, so an empty ledger for one team returns entries from every team.Pass
scopethrough and filter one.team_id == ^scope.team_id. -
medium
Retry loop without backoff
lib/payments/export_worker.ex:40 · reliabilityOn
{:error, _}the worker calls itself straight away, with no delay and no limit.Return the error and let the job queue's backoff retry it.
-
low
Empty-ledger path has no test
lib/payments/store.ex:83 · testsThe new
[] ->branch is never exercised.Add a test that exports a period with no entries for the team.
Analysis complete.
PR #482 · 3 findings · score 72The diff is gone. The findings stay.
ReviewPilot keeps the engineering evidence, not your source code. Retention is zero days by default.
Source retention for this teamDeleted right after analysis.
on disk: 19 lines of source · 3 findings
acme / settings / engines
Your key. Your contract.
Your diff passes through our servers, goes to the AI provider your company already approved with your key, and is deleted as soon as the analysis ends (default). You pay their list price; we never resell the tokens.
Engine
Anthropic key · encrypted with AES-256-GCM · never shown again
Source
- GitHubtoken or App
- Bitbucket CloudTeam plan
Read-only access; write only if you turn on publishing. Both can be connected to the same team at once.
Triggers
- openedauto
- reopenedauto
- synchronizeauto
- ready_for_reviewauto
Signed GitHub webhooks, verified with HMAC. Or paste any PR or branch URL.
Comments
Optional: the verdict is posted back as a GitHub review, inline on the changed lines.
Guidance
Adds your stack and conventions to every review. It can never override ReviewPilot's own rules.
Re-run any review on new commits or another model. Earlier findings and triage stay intact.
⌘K searches reviews, branches and repositories within what each role may see. The bell lights up the moment a review finishes.Plans
Plans price the product, not the tokens. Your AI usage is billed by your provider, at their list price.
| Plan | Price | Repositories | Seats | Reviews / month | AI tokens / month | Bitbucket · guidance · retention |
|---|---|---|---|---|---|---|
| TrialOne repository, 14 days. | Free | 1 | 1 | 20 | 500,000 | no |
| SoloAn independent developer. | $19/mo | 3 | 1 | 150 | 2,000,000 | no |
| TeamEvery pull request, every engineer. | $49/mo | 20 | 5 | 1,000 | 10,000,000 | yes |
| UnlimitedNo usage ceilings. | $249/mo | unlimited | unlimited | unlimited | unlimited | yes |
A warning at 80% of the monthly AI quota, a clear stop at 100%.
The trial is free and never renews or charges you on its own.
14-day money-back guarantee.
Full pricing
Questions teams ask first
Do you store our source code?
Not by default: the diff is deleted as soon as the analysis finishes. Owners can keep it for 7 or 30 days, after which it is purged automatically. Findings, score and metadata remain.
Which AI provider sees our code?
Only the one you configure: OpenAI, Anthropic or Google Gemini, with your own API key and under your own agreement with them.
Which platforms are supported?
GitHub and Bitbucket Cloud, both pull requests and direct branches. Automatic webhook reviews are available for GitHub.
Can the AI learn our conventions?
Yes. Team owners write review guidance (stack, conventions, domain rules) that is added to every review. It can only add context; it cannot change or switch off ReviewPilot's own rules.
What happens when we reach the plan's usage?
You see a warning at 80% of the monthly AI quota. At 100%, new reviews pause until the quota resets on the 1st, and nothing is billed beyond the plan.
What access does ReviewPilot need?
Read-only tokens that can list repositories and read pull requests and their contents. Write access to pull requests is needed only if you turn on publishing reviews to GitHub.
acme / reviews / new
Paste your own pull request.
GitHub, or Bitbucket Cloud on Team plans. Free for 14 days, 20 reviews on your own key.
Running review for a regulated team? Apply as a design partner.
scope.team_id.