Code review, rules first, model second.
Paste code and press Review. 31 static rules flag secrets, injection and common bugs in under a millisecond. Then an AI review streams in, issue by issue, looking for what the rules can't see, and every fix is shown as a diff.
Demo password: demo1234. Pick one of the samples (each has planted bugs) and press Review.
Two passes, each doing what it's good at.
Rules are instant, free and give the same answer every time. A model can follow logic. BugLens runs both, and tells the model what the rules already found.
Static rules, instantly
Hardcoded secrets, SQL and shell injection, eval, unsafe YAML and pickle, disabled TLS checks, == in JavaScript. Where the fix is mechanical (== None → is None), the rule makes it.
AI review, streamed
Issues arrive one by one over Server-Sent Events: logic errors, edge cases, missing error handling, and the fixes rules can't make, like a parameterised query.
Fixes as diffs
Each fix is a find/replace that's applied only if it matches exactly one place. The result is shown side by side or unified, with changed words highlighted.
What it looks like
A finished review with the annotated code and issue list, one issue opened with its own before and after, and the full suggested diff.
Key concepts & stack
Masked scanning
Rules match against a copy of the code with strings and comments blanked out, same length, so eval( in a docstring isn't flagged and line numbers still match.
Find/replace fixes
Asked for the whole corrected file, the model reformatted everything. Now each issue carries find and replace, and a fix that doesn't match is dropped instead of guessed.
Repeats become fixes
When the model re-reports a rule finding anyway, it's merged into that finding as its fix instead of showing up twice.
Own diff and SSE parser
An LCS line and word diff and a small SSE reader over fetch, so the review can be POSTed and streamed.
Works without a key
With no LLM key, or the AI box unticked, you still get the rules and their fixes.
Any OpenAI-compatible model
Groq by default, or OpenAI, or a local Ollama, through one LangChain ChatOpenAI client.
Run your own
A Groq key is free; without one, BugLens still runs the static rules.
API
- 1Install, then set
APP_PASSWORDandLLM_API_KEYin.env:cd backend && uv sync cp .env.example .env - 2Start it on port 8000:
uv run uvicorn app.main:app --reload
App
- 1Install and start Vite:
cd frontend && npm install npm run dev - 2Open it, pick a sample and press Review:
http://localhost:5173