Diffwise comments on the lines your pull request adds, ranks every finding by severity, and never approves on its own.
Tighten vendor health check
feature/health-check into main
Changes requested
src/monitoring/vendor-checks.ts
+6 −2
Diffwise runs as a job in the CI you already have. It fires on every pull request and talks back in the review thread.
When a pull request opens, Diffwise pulls only the changed hunks. Anything shaped like a credential is masked before a model sees it.
+ const apiKey = "sk_live_••••••••" redacted before review
Your model reads the hunks against the rule packs you switch on. Stable instructions are cached, so every run after the first costs less.
rules security, cost-safety, regression model claude | gpt | self-hosted
Findings land on the exact line, three per file at most. Critical findings block the merge. Approving stays a human decision.
critical reject (-10) >3 important wait for author (-5) anything else comment, no vote
Critical
Hardcoded secrets, injection, auth bypasses, sensitive data leaking into logs or events, paid APIs called on a timer.
Blocks the PR with a Reject vote.
Important
Race conditions, leaked connections, missing awaits, unhandled I/O failures, event schemas changed under their consumers.
More than three asks the author to wait.
Suggestion
Behavior changes, swallowed errors, risky defaults, performance. One per file, so they never bury the rest.
Left as a comment. No vote.
Each pack is plain text the model follows. Add your own guidelines the same way.
Catches a misconfigured health check hammering a billable vendor API, polling loops with no stated volume, and two code paths paying for the same call.
volume check
Fix: point the check at the vendor's free status endpoint and send no payload.
Secrets, injection, auth gaps, sensitive fields sent where they shouldn't go.
DB_PASSWORD=••••••••
Sync calls turned async, renamed storage keys without a fallback read, event schemas that drift from their consumers.
Flags significant new behavior that ships without a rollout switch, and toggled features whose side effects run either way.
if (!flags.enabled("new_refunds", org)) return legacyRefund(req);
Spots config keys, routes, migrations, and error handling silently dropped while someone resolved a merge or rebase.
- router.post("/refunds", validate, refund)
- PAYMENTS_TIMEOUT_MS=8000
Line comments go on lines the pull request adds. Problems that were already there get one mention in the summary, never pinned on the author.
Diffwise votes only to stop a risky merge, and clears its own vote once the fix lands. The approve button belongs to a person.
Credential-shaped strings are redacted before review and in every comment Diffwise posts, so a leaked key never gets quoted twice.
Use Claude, GPT, or any OpenAI-compatible endpoint, including vLLM, Ollama, or LiteLLM running on your own hardware.
The rules and instructions are cached between runs, which cuts token spend by roughly 60 to 70 percent. Most reviews post their comments in 30 to 60 seconds.
typical review
Measured with a mid-tier Claude model. Your model choice sets your price.
DevHub already knows your architecture, owners, tickets, and release history. Inside it, review findings flow into alerts, tickets, and the rest of your delivery picture, on GitHub and GitLab as well as Azure DevOps.
Explore DevHubTell us about your repos and how your team reviews today, and we'll get Diffwise running on your next pull request.
This health check now POSTs a payload to
/v2/verify, a billable endpoint, every 60s. That is 1,440 paid calls a day per environment. Keep the free status check.Suggested change
timedFetch(`${BASE}/status`),