How AI Code Review Works#

Codluma performs a multi-stage analysis on every pull request diff, combining deterministic pattern matching with large-language-model semantic understanding to catch issues that neither approach could find alone.

The review pipeline

Timing & latency

Severity Guide#

Every finding is assigned one of four severity levels calibrated to real-world risk — not to inflate numbers or generate noise.

Finding Categories#

Every finding is tagged with one of eight categories. You can enable or disable individual categories per repository in Settings → Review Rules → Categories.

Strictness Levels#

Strictness controls how aggressively the AI reviews. It affects both which categories produce findings and the confidence threshold required before a finding is posted.

Custom Review Rules#

Custom rules let you encode your architecture decisions, forbidden patterns, required libraries, and style standards so Codluma enforces them automatically on every PR.

Rule types

Configuring rules via reviewops.yml

Add a reviewops.yml file to the root of any repository to configure rules for that repo.

# reviewops.yml — place in repo root
version: 1

review:
  blocking_severity: critical   # critical | high | medium | off

  forbidden_patterns:
    - pattern: "console\.log"
      message: "Remove debug logging before merge"
      severity: medium
      files: ["src/**/*.ts", "src/**/*.tsx"]

    - pattern: "TODO|FIXME|HACK"
      message: "Resolve outstanding TODO/FIXME before merging"
      severity: info

  exclude:
    - "**/__generated__/**"
    - "**/vendor/**"
    - "**/*.min.js"

  ai_instructions: |
    This codebase uses React Query for all data fetching.
    Flag any direct fetch() or axios calls in component files as High severity.
    All database queries must go through the repository layer in src/repositories/.
    Flag any direct DB calls in service or controller files as Critical.

Fix Suggestions#

For Critical and High findings, Codluma generates a concrete code fix alongside the explanation, shown directly in the GitHub/GitLab review comment.

Example fix suggestion

### 🔴 Critical — SQL Injection  (src/users/UserRepository.ts:47)

**Issue:** The `userId` parameter is interpolated directly into the SQL string.
An attacker controlling this parameter can execute arbitrary SQL.

**Vulnerable code:**
```typescript
const result = await db.query(`SELECT * FROM users WHERE id = ${userId}`)
```

**Fix:**
```typescript
const result = await db.query('SELECT * FROM users WHERE id = $1', [userId])
```

> Use parameterized queries for all user-supplied values.

When fixes are generated