Zavton Verdict · private alpha from late November

AI code review that only speaks when it matters.

Zavton Verdict reviews every pull request for bugs, security issues and engineering quality, and says clearly when there is nothing to fix.

Join the waitlist See a real review

At most 5 findings per PR
Re-reviews free
Code not stored after the review

2 issues to fixNo issues found

zavton-verdictbotcommented · edited just now

Verdict by Zavton —2 issues to fix

High 1 · Medium 1 · Reviewed 7 files · 1 skipped (generated)

What this PR does: adds retry logic to the payment webhook handler and moves idempotency keys to Redis.

Severity	Issue	Where
High	Retries can double-charge: nothing stops a second charge after a timeout	`webhooks/pay.ts:88`says when it breaks, not “consider…”
Medium	Redis keys never expire, so memory grows without bound	`lib/idem.ts:21`two findings. no nits.

Zavton CR-1 · 41 sResolved since last review: 0Thumbs up or down on each comment@zavton help

Verdict by Zavton —No issues found

Reviewed 4 files · nothing skipped

What this PR does: lets team admins invite members by email, with a signed token that expires in 48 hours.

Checked

auth on /invite
null paths in parseToken
error handling in sendEmail
token expiry

Considered, not flagged (2)

Unchecked res.json() at L52: guarded by the status check at L40.

Loose email pattern: the invite is confirmed by link, so a bad address can’t join.

silence, explained.

Zavton CR-1 · 23 sThumbs up or down@zavton help

Why quiet

Bots that comment on everything get muted. Then real bugs slip through.

Verdict is built the other way round: say less, and make every word worth reading.

Noisy reviewers train teams to stop reading.

Thirty comments on a PR means the one that matters is buried. Verdict posts at most five findings, and often none.

Per-seat and per-run pricing adds up fast.

You pay once per reviewed pull request. Re-reviews on the same PR are free, and you can set a spend cap.

Most AI reviewers send your code to someone else’s model.

Verdict runs on Zavton CR-1, our own model. Code is reviewed in memory and discarded after the review.

How it works

Install once. Then it simply shows up.

Install the GitHub App
Pick the repos Verdict may read. About two minutes, no config file needed.
Open a pull request
Verdict reviews it in minutes and keeps one summary comment, edited in place on every push.
Fix, dismiss or ignore
A thumbs-down with a reason teaches Verdict what your team cares about. No weeks of tuning.

A real review

Every finding says when it breaks.

Severity, a concrete failure, the reason, and a fix you can commit in one click. And a short list of what it chose to leave alone.

webhooks/pay.ts86  const event = parse(req.body);87  for (let i = 0; i < MAX_RETRY; i++) {88    const result = await charge(event);89+   await idem.save(event.id, result);90    if (result.ok) break;

HighCorrectnessRetries can double-charge

When it breaks

The provider charges the card but the response times out → result.ok is false → the loop calls charge() again → the customer pays twice.

Why

Nothing ties the retries to one charge: the key on line 89 is saved only after a charge returns, and the provider is never given it.

Fix

// let the provider dedupe the retries
const result = await charge(event, {
  idempotencyKey: event.id,
});

Confidence: highMedium if charge() already dedupes by event id

Left alone in this PR

Formatting and styleYour linter’s job. Verdict never comments on it.
“Consider…” suggestionsNo hedged nits. If it can’t name a failure, it doesn’t post.
Considered, not flagged (1)retryCount shadows an outer name: no behaviour change.

Principles

Three promises, kept by design.

Quiet

At most five findings per PR, each with a concrete failure scenario. No style nits. When there is nothing to fix, it says so plainly.

Fair pricing

Pay per reviewed pull request, once. Re-reviews are free. Set a spend cap. Free for open source.

Private

Runs on Zavton CR-1, our own model. Your code isn’t sent to third-party AI providers and isn’t stored after the review.

For startups with 5–50 engineers and no time for a second reviewer on every PR, and open-source maintainers reviewing outside contributions.

TypeScript
JavaScript
Python
Go
Java

Waitlist

Get a quieter reviewer on your next PR.

Private alpha from late November 2026. Public beta in January 2027. Price announced at beta.

Is my code stored?

No. It is processed in memory and discarded after the review.

Which model reviews my code?

Zavton CR-1, our own fine-tuned code-review model.

Do you train on my code?

No, unless your organisation explicitly opts in.

Which platforms?

GitHub first. GitLab at general availability.

How much will it cost?

You pay per reviewed PR, and it’s free for public repos. The price is announced at beta.