Automatically review your PRswith your own Anthropic API key
Automatically reviewyour PRs with your ownAnthropic API key

Ship faster. Break nothing. A second pair
of eyes on every pull request.

Get started Docs

The diffy dashboard: live status, tokens and reviews, and a heatmap of reviews over the last year

src/search.js

Comment on lines +10 to +16

diffyreviewBot3 days ago

High — Off-by-one error in averageOrder loop

The loop condition `i <= orders.length` attempts to access an index equal to `orders.length`, resulting in `TypeError: Cannot read properties of undefined` when trying to access `.amount` on the last iteration.

Suggested changeCopy

10+function averageOrder(orders) {
11+  let total = 0;
12+  for (let i = 0; i < orders.length; i++) {
13+    total += orders[i].amount;
14+  }
15+  return orders.length > 0 ? total / orders.length : 0;
16+}

Fix prompt for your coding agent

From pull request to posted review, diffy does the reading for you.

01
A pull request opens
GitHub tells diffy through a webhook. There is nothing to add to your CI.
Explore more
Add rate limit to the login route #482
Opendcarter wants to merge 3 commits into main from feat/login-rate-limit
Conversation4Commits3Checks2Files changed7
dcarter commented 2 days agoMember
Description
Sign in has no limit on failed attempts, so a script can keep guessing passwords for as long as it likes. This change counts failed attempts per account and blocks sign in for a while once the limit is reached.
The implementation:
Counts failed sign-in attempts per account in a sliding 15 minute window.
Blocks sign in with a 429 once an account reaches 5 failed attempts.
Resets the count after a successful sign in.
Adds the limit and the window to the config, with tests for both.
02
diffy reads the change
It reads the diff with the files around it and a short brief of the project, so it knows what the change touches.
Explore more
src/auth/login.ts+5−2
@@ -1,5 +1,6 @@
1import { hash } from './hash'
1import { hash } from './hash'
2import { sign } from './sign'
2import { sign } from './sign'
3+import { Limit } from './limit'
3
4
4@Injectable()
5@Injectable()
5export class LoginService {
6export class LoginService {
@@ -14,11 +15,13 @@ export class LoginService {
14 constructor(
15 constructor(
15 private db: Db,
16 private db: Db,
16− private clock: Clock
17+ private clock: Clock,
18+ private limit: Limit
17 ) {}
19 ) {}
18
20
19 async login(email, password) {
21 async login(email, password) {
22+ await this.limit.check(email)
20 const a = await find(email)
23 const a = await find(email)
21 if (!a) throw new Denied()
24 if (!a) throw new Denied()
22− return sign(a)
25+ return sign(a, this.clock)
23 }
26 }
24}
27}
03
Your model reviews it
The review runs on the model you picked, with your own API key. Your code goes to that provider and nowhere else.
Explore more
04
One review is posted
Comments on the lines they are about and a single summary, under the heading Summary.
Explore more
diffyreviewBotjust now
Critical — The rate limit is skipped by changing the case of an email
The count is kept for the email as it was typed, so Alice@example.com and alice@example.com each get their own five attempts.
Suggested change
4−async isBlocked(email: string) {
5− const key = email
6− const count = this.counts.get(key)
7− return (count ?? 0) >= LIMIT
8−}
4+async isBlocked(email: string) {
5+ const key = email.trim().toLowerCase()
6+ const count = this.counts.get(key)
7+ return (count ?? 0) >= LIMIT
8+}
Apply suggestionAdd suggestion to batch
Fix prompt for your coding agent

Bring the model you already pay for. Switch whenever you like.

Each organization adds its own API key. Keys are encrypted and stay on your server.

Anthropic
OpenAI
Google Gemini
OpenRouter

Questions, answered

Where your code goes, what diffy reads, what it costs and how you shape a review.

Where does my code go?
diffy reads the pull request from GitHub on the server you run, and sends the parts it needs to the model you picked, with your own API key. It goes to that provider and nowhere else, and the review is posted back to the pull request.
What does diffy read when it reviews?
The diff, the function or class around each change, and small files in full. Before every review it also reads a few documents from the default branch: the context files you name, rules files such as AGENTS.md, the README and CONTRIBUTING.md, and a short brief of the repository. Lockfiles and generated files are skipped, and the review lists the documents it read.
How are my API keys kept?
A key is encrypted before it is saved, and the secret that unlocks it stays on your server. It is never shown again: the settings show only its last four characters, and an error that could echo a key is cleaned first.
What does a review cost?
You pay your model provider for what the reviews use; diffy adds nothing to that. The cost grows with the size of the change, and the dashboard shows the usage. A setting can send plain patches instead of the code around them, which is cheaper and shallower.
Can I configure it myself?
Yes. A .diffy.yaml file at the root of the repository sets the language of the review (English or Thai), whether it is chill or assertive, instructions for the whole project or for certain paths, more documents to read, and files to ignore. It is read from the default branch, so a pull request cannot change the rules of its own review.

Stop skimming PRs.Start shipping impact.

Get started

Automatically review your PRswith your own AnthropicAnthropic API keyAutomatically reviewyour PRs with your ownAnthropicAnthropic API key

From pull request to posted review, diffy does the reading for you.

A pull request opens

diffy reads the change

Your model reviews it

One review is posted

Bring the model you already pay for. Switch whenever you like.

Questions, answered

Stop skimming PRs.Start shipping impact.

Automatically review your PRswith your own Anthropic API key
Automatically reviewyour PRs with your ownAnthropic API key