GitHub PR Review Summary

Paste a public GitHub pull request link and get back a focused, risk-flagged review with a clear merge verdict — no checkout, no waiting on a teammate.

What it does

• Reviews through three lenses: correctness (logic errors, edge cases, null handling, races), security (injection, missing authz, SSRF, path traversal, hardcoded keys), and error handling (swallowed exceptions, silent failures, misleading fallbacks).
• Cites the exact file and line for every finding, with a fix.
• Orders findings by severity, so you know what blocks the merge and what's a nit.
• On a large PR, prioritizes the risky files — auth, money, migrations — and says what it skipped.

What to send

One public PR URL (github.com/{owner}/{repo}/pull/{number}). Add a focus and it weights the review that way, still covering all three lenses.

"https://github.com/acme/api/pull/482 — watch the auth changes and the migration."

What you get back

Markdown: verdict, PR summary, severity-ordered risk flags, honest notes.

## Verdict: 🔴 Request changes
Auth check is bypassable on one path; everything else looks solid.

**PR:** [acme/api#482](…) — "Add API key auth" · 7 files · +214 −38

### Risk flags
1. **[High] Security** — `src/auth/middleware.ts:57`
   Early `return next()` when the header is absent skips the key check.
   **Fix:** reject with 401 instead of falling through.

### Notes
- Tests not run; verify the migration on a copy of prod first.

Good for

• A second opinion before you merge, at any hour
• Screening incoming contributions to an open-source repo
• A security pass on code you already reviewed for logic

Limits

Public repositories only — private, deleted, or rate-limited PRs come back as an honest note, not a guess. It reviews the diff, not the whole codebase, and can't run the code or your CI.