r/codereview

its a password generator https://www.online-python.com/QKSXRZenuB could i get some tips on coding in python, i want to get better

Disclaimer: I'm not anti-AI and I'd like to hear from people who are finding success with code reviews. Ideally, I'd like to have a discussion that's a bit more involved than just "AI bad lol".

So I've been giving AI code reviews a shot for the past couple weeks to try to help with the code-review bottleneck that we, like many other teams, are facing due to individual contributors being able to generate code much faster than before. However, I don't get how they are useful. Here's a typical workflow I've experienced :

1. Junior sends in a PR, it's obviously mostly AI generated code. Such is life these days.

2. I ask them if they asked for reviews to their AI agent of choice before sending it my way. Their answer: yes, three times.

3. ok fine, I give it a shot. I also ask for a review from an AI agent, with the supposed added value that, since I have more experience, I'll be able to judge the quality of that review better. I'm not sure I agree with this assumption I've been hearing, but let's just assume this is how it works.

4. The AI review comes out with 4 comments, 2 of them i find neat and the other 2 a bit nitpicky. Fine, but im curious... what if I implement these changes locally, and ask another agent to review this new code version in the context of the PR?

5. New agent finds 5 new "issues" to correct. Wtf? Ok now im curious, so I start looping for 5-6 iterations just to see where this goes. Every single time, it digs deeper to find something to complain about. Turns out the AI reviews can be chained pretty much infinitely and a new model or agent will always find something to "improve" on the PR and find a reason to not accept the merge... at least in my limited experience with them.

Am I missing something? People have been praising code reviews as an "actual good usecase" for AI, but I don't see it. In my experience, the agents just find too many ways to simply chain-critique the code. The agent's job is essentially to find holes in the PR, and it will dig relentlessly until it finds something to complain about. I have not seen a single "yep, that PR looks 10/10 now" from any agent in the 2 weeks I tried them.

I keep seeing "AI code review" tools and my honest first reaction is probably yours too: an LLM reviewing LLM-written code is often slop reviewing slop. So instead of asking anyone to trust a bot, I tried to measure the thing can frontier models actually catch real, shipped bugs, and how often do they cry wolf?

What I did

• Took real historical regressions actual CVEs from Keycloak, Django, and Spring and reintroduced each one into the code, with the upstream fix as the ground-truth answer. These are bugs maintainers actually shipped and later patched, not bugs I wrote to flatter a model.
• Ran Claude, GPT-4o, Gemini, and DeepSeek over each, blind, and scored the three things these tools usually hand-wave:
  • Detection rate - did it catch the planted bug?
  • False positives - how much noise on clean diffs?
  • Consistency - same diff, same model, run twice: does it even agree with itself?

What I found (real numbers from the leaderboard)

The spread on hard regressions is brutal and binary. On the vLLM deserialization-RCE regression and the Parse Server operator-injection-account-takeover regression, Claude Sonnet and Gemini 2.5 Pro caught the bug on all 3 runs — and GPT-4o and DeepSeek missed it on all 3. Same diff, opposite outcome depending on the model.

A miss plus noise is worse than silence. On that Parse Server regression, GPT-4o and DeepSeek didn't just miss the real bug they each raised false positives on top of it, netting a negative weighted score (−8.9). The wrong model doesn't just fail to help, it actively wastes your triage time.

"Caught it" ≠ "told you it mattered." On the cross-file suite, DeepSeek flagged 100% of the planted bugs but mis-rated severity on every one real high-severity issues quietly downgraded to medium/low. Detection and calibration are separate problems, and most tools only talk about the first.

The thing that surprised me: run-to-run consistency was basically perfect across every suite, the same model on the same diff gave the same verdict three times (zero variance). The flakiness I expected wasn't the failure mode; which model you pick was. That's the whole argument for measuring it.

The part I'll defend: this isn't "trust my reviewer." It's a public, vendor-neutral leaderboard, I don't sell a "reviewer model," I score the ones you already pay for, and every result links to the real CVE and its upstream fix so you can check my work. If the method is wrong, it's wrong in public.

On the obvious objections, because I'd raise them too:

• "It's still just an LLM." Yes and the data shows they're uneven and miss real things (complex authorization logic especially). The point isn't "LLMs are great," it's "here's exactly where each one is and isn't trustworthy, measured." Using a second, independent model (not the one that wrote the code) and cross-model agreement helps, but I publish the misses too, not just the wins.
• "This replaces SonarQube / linters." It doesn't, and I won't claim it does. Static analysis is deterministic and catches a different class of thing. LLMs catch semantic/intent bugs linters miss, and miss things linters catch. Complementary, not a replacement.
• "Where does my code go?" You bring your own API key, the diff goes to your Anthropic/OpenAI/Google/DeepSeek account, reviewed in memory, not stored by me, never used for training. And I checked my own site so I'm not a hypocrite about it: no Google Analytics, no third-party trackers, no marketing pixels. The only browser storage is your theme choice and your login session.

Where I actually want holes poked:

• Is "reintroduce a historical CVE" fair, or does it leak hints a real PR wouldn't have?
• Better ways to measure false positives than what I'm doing?
• Does cross-model consensus actually cut noise in a real workflow, or just average it?

You can browse the leaderboard with no signup: https://www.benchmodel.io/leaderboard. If you want to run your own diff, paste one, or just a GitHub PR URL, though that part needs a login + your own key, which I know is friction.

Building this solo and in the open about the method. Tear the methodology apart, genuinely the most useful thing you can do for me.

Hey everyone,

After months of building, I finally launched my first SaaS: Mitorix.

The idea came from a problem I kept running into as a developer. Every time I joined a new project, I spent days trying to understand the architecture instead of actually building features.

Questions like:

Where does authentication start?

How does the payment flow work?

What breaks if I change this file?

...always took far longer to answer than they should.

So I built Mitorix.

You paste a GitHub repository URL, and it analyzes the codebase so you can:

Chat with your codebase using AI

Visualize the architecture with an interactive dependency graph

Understand the impact of changes before editing code

Scan for common security issues

Repositories are processed temporarily and deleted immediately after analysis. AI processing currently uses Gemini and Groq APIs.

This is my first SaaS, built completely solo with zero funding, so I'm sure there are things I can improve.

I'd genuinely appreciate any feedback, whether it's about the product, UX, pricing, or features you'd expect from a tool like this.

Website: https://mitorix.site

Thanks for taking a look!

Hey everyone!

I'm a second-year B.Tech student and I've been learning AI/ML and web development over the past few months. I recently built my first AI-powered web application using Google AI Studio and successfully deployed it on Vercel.

This project helped me learn a lot about:

• React + TypeScript
• Git & GitHub workflow
• Environment variables
• Vercel deployment
• Working with the Gemini API

It definitely wasn't a smooth journey 😅. I ran into issues with Git remotes, environment variables, and deployment, but solving those problems taught me much more than just writing code.

I'd really appreciate any feedback on:

• UI/UX
• Performance
• Code structure
• Features I should add
• Anything that could make it more production-ready
• Live Demo: [https://vercel.com/naitikjha1845-2959s-projects/ai-trust-lens]
• GitHub: [https://github.com/Naitikjha]
• I hope you enjoy trying it out! 😄 If you have any suggestions, spot any bugs, or think there's something I could improve, I'd love to hear your feedback. As a student, advice from experienced developers and the community is incredibly valuable and helps me become a better developer. Thanks for your time!

Started making a server in go, where I was trying to write the handlers, routing and server start/stop etc. from scratch, until i realised I should have maybe used the net/http module and make my job easier. This is an incomplete version and still has to be finished: https://github.com/SaiVikrantG/mini-projs/tree/main/client-server-go/server

Am I going a layer too deep, and should i just use the the net/http module or is this the correct way?

I need suggestions and review of my code format, I consider this my first ever project. I am worried about spaghetti code and other problems. So please list out all problems you can. Thanks.

#include <stdio.h>
#include <stdbool.h>
#include <stdlib.h> //for random values feature
#include <time.h> //for random values feature
#define LENGTH 10
void Random(int *arr, int *element);
int main(){
  int element, index;
  int arr[LENGTH];
  bool found=false;
  Random(arr, &element);
  printf("LINEAR SEARCH");
  for(int i=0; i<LENGTH; i++){
    if(arr[i]==element){
      found=true;
      index=i;
      break;
    }
  }
  if(found){
    printf("\nElement %d found at index %d.\n", element, index);
  }
  else{
    printf("\nElement not found in the array.\n");
  }
  printf("--------------------------------------------------------------\n");
  return 0;
}
//Random Values Assigner
void Random(int *arr, int *element){
  srand(time(NULL));
  int Option1, Option2;
  //Array choosing
  while(1){
    printf("--------------------------------------------------------------\n");
    printf("Enter the elements in array:\n1 - Manual\t2 - Random\nChoose: ");
    scanf("%d", &Option1);
    if(Option1==1){
      printf("Enter elements separated with spaces(Max 10 elements): ");
      for(int i=0; i<LENGTH; i++){
        scanf("%d", &arr[i]);
      }
      break;
    }
    else if(Option1==2) {
      for(int i=0; i<LENGTH; i++){
        arr[i]=rand()%100;
      }
      break;
    }
    else{
      printf("Choose from options.\n");
      continue;
    }
    printf("--------------------------------------------------------------\n");
  }
  //Element choosing
  while(1){
    printf("--------------------------------------------------------------\n");
    printf("Enter the element to search for:\n1 - Manual\t2 - Random\nChoose: ");
    scanf("%d", &Option2);
    if(Option2==1){
      printf("Enter the element to search for: ");
      scanf("%d", &element);
      break;
    }
    else if(Option2==2) {
      *element=arr[rand() % LENGTH];
      break;
    }
    else{
      printf("Choose from options.\n");
      continue;
    }
    printf("--------------------------------------------------------------\n");
  }
  //Printing Choices
  printf("--------------------------------------------------------------\n");
  printf("Array: ");
  for(int i=0; i<LENGTH; i++){
    printf("%d ", arr[i]);
  }
  printf("\nElement: %d\n", *element);
  printf("--------------------------------------------------------------\n");
}

Here is the program on github if it is easier to read on there: https://github.com/PLEASENTIA/DSA/blob/main/Algorithms/Searching/LinearSearch.c

I have heard common complaints that vibecoding leads to bloated, dead, and zombie code - how much can that be reduced by having a code review loop. For example, let’s say you write code with Claude code, then have Gemini and CharGPT review the code before implementation, then Claude executes.

Today's feature is a Text Diff Checker.

Instead of only showing differences, I wanted it to support actual workflows.

Current features:

• Side-by-side comparison

• Highlight additions

• Highlight deletions

• Cherry-pick changes

• Merge content

• Copy final output

• Download the resulting file

I've noticed developers spend a surprising amount of time comparing:

• API responses
• JSON files
• SQL scripts
• Documentation
• Generated AI content

Curious to hear from others:

What do you compare most often?

JSON?

Markdown?

Code?

Configs?

SQL?

Prompts?

Trying to understand which workflows are worth improving next.

TL;DR - I made a metronome app to learn some tech I've never used before, with Claude Code's help, and I want to make sure I'm learning the right stuff and making something that isn't garbage. Please review it (if you want, but I'd really appreciate it). Have a great day!

I'm trying to transition out of games development (primarily C++, with occasional dips into C#/Python) and back into "traditional" software. To get some experience I got Claude Code to help me write a little metronome web app.

It's a pretty standard metronome (tempo and time signature controls), with some little quality of life niceties (I think), and it allows saving presets locally, in my database (with authentication), or to a Google Drive.

I wanted to try and treat it like an actual product, but that also means I needed Claude to help me do a bunch of stuff I've never done before. So the API, MySQL database, and the web server, are all in Docker. I set up an auth flow, so if you're a registered user you can save presets on the server, if not it's all stored locally.

The front-end is all React, and I learned about hooks and how to write components and tests and all that fun stuff (not to mention, just, Typescript). The backend is C#/.NET.

I say all this just because, almost none of this is tech I've use before (except C#, but that's just minor stuff), architecture I've had to set up before, or considerations I've had to make before. Claude, obviously, did most of the setup, and give me some templates (how to write/use React hooks and components), and I still let it handle most of the CSS because that stuff is still wizardry to me (endless props to you front-end devs out there), but I did still write a lot of the actual code. But again, I'm learning basically this entire stack, so I'm truly not sure if this is good, or would be maintainable.

I'm enjoying this project, and I have plans to make it cross-platform (because I really want to use it), but I figured I should make sure it's not completely garbage before I make a terrible mistake.

If you do look at it, I really appreciate it, and I'd love your feedback. If you don't, that's cool too.

Hope you have a great day!