Code review & security/audit tools - any recommendations?

Tips & Tricks
, , , ,
21

Fun :grin: so what’s the process you follow to use it?

22

Basically just following git and review at the pull request before merging.

1 Like
23

In CodeRabbit, I simply prompted: @coderabbitai full review

In Replit Plan mode I prompted:
Please perform a comprehensive security and code quality review of the codebase. Analyze the entire project and create a detailed task list for improvements in these areas:

  1. Security Analysis

  2. Code Quality

  3. Architecture Review

  4. Healthcare Compliance

  5. Performance & Scalability

For each issue found, provide:

  • File location and line numbers
  • Severity level (Critical/High/Medium/Low)
  • Specific recommendation
  • Code example of the fix

Create a prioritized task list for addressing these findings.

1 Like
24

Yes I have a similar audit prompt I wrote to run in Replit’s plan mode, and am generally happy with the results.

But I am curious if running Coderabbit on my app as an alternative to my own audit prompt is worth it?

25

I have decided CodeRabbit is not what I want for reviewing my Replit apps.

I started playing with it properly today, and seems it only works off repo pull requests. i.e. it only scans newly changed files.

But I want to take a finished app and say “review the entire codebase”. But to achieve this, I would have to create a pull request where I had touched (changed) all files.

My ongoing audit process:

Yet again, the answer is “no external tools needed. Just use Replit for everything”

I will continue with my own auditing prompt that I drop into the agent. And it is free, unlike CodeRabbit’s $24/month :blush:

26

Personally, I’ve enjoyed it a lot. It did catch some things that Replit did not. I’m running a prompt in Replit, npm audit in Shell (npm installed), then CodeRabbit.ai before merge. I really like how it generates documentation and you can set how nit-picky it is with the code to bring up suggestions on changes/security risks. Looks like it has a bit more functionality than that, but need to take the time to learn it better among the million other things I have on my to-do-list.

1 Like
27

I think like @rajharrykissoon said there is a way to prompt full review.

I do remember in the initial review there is a token limit, so if it’s a large app it might not be the right fit.

I’m thankful for it though because it caught a big vulnerability that npm/replit did not (and it had been there for a while).

1 Like