Excubitor reviews AI-written code on a laptop or as a gate in your pipeline. Safe, reversible fixes are kept only after your own tests pass. Anything security-sensitive waits for a person. We never hold access to your repositories.
{
"type": "tool_call",
"agent": "excubitor.codereview",
"payload": {
"category": "security",
"rule": "unsafe_deserialization",
"file": "api/import.py",
"decision": "held",
"reason": "security-sensitive fix waits for a person"
},
"evidence": {
"input_hash": "b19f…2a",
"output_hash": "d004…7e"
}
}
What happened, why it matters and what to do, for a team with no security specialist.
A safe fix is kept only after the project's own tests pass, and reverted if they fail. With no test gate, it is held.
The gate runs inside your pipeline and reports identifiers outward, never the diff.
excubitor-cigate, with templates for the two common pipeline services, fails a change on what you choose to block.
Security-sensitive and system-modifying fixes wait for a named person's approval, signed into the ledger.
Every finding from every run, in one signed log, rather than a conversation per pull request.
Included in every platform edition, for every developer. There is no separate code review product.
Every item names the release that carries it. Releases are signed, and each lists the commands to check them before you install.
Code review, tiered fixes behind your tests, the CI gate and its templates, in the first complete signed release.
No standing vendor access, ever. Managed with evidence, never on faith.