Critiq team
- ci
- guides
Automate pull request review checks in GitHub Actions
Automate PR review checks with critiq-action: diff scans, inline comments, severity gates, and reusable workflows on every pull request.
Read articleBlog
Code review, CI, rules, and security
Engineering notes on deterministic code review, pull request workflows, security rules, and OSS updates from the Critiq team.
Blog posts
All topics
16 articles
- rules
- guides
Linting vs rule-based code review: what each layer catches
Compare linting vs rule-based code review: style and syntax from ESLint and friends, security and correctness from inspectable Critiq rules.
Read article
- ci
- guides
How to integrate Critiq in your GitHub workflow
Integrate Critiq in your GitHub workflow: local checks, pull_request scans, branch protection, and monorepo paths with critiq-action.
Read article
- ai
- rules
Rule-based vs AI code review: reproducible findings at merge time
Rule-based vs AI code review: stable rule IDs and local reproduction vs fluent PR summaries that shift between runs.
Read article
- ai
- rules
The trust gap in AI-assisted coding, and what inspectable feedback looks like
AI code review vs rule-based review: why developers distrust PR bots and how inspectable rules, evidence, and local checks close the gap.
Read article
- ai
- rules
What evidence over vibes means in code review
Evidence-based code review ties findings to a rule, line, severity, and references, not confident prose or AI vibes on the pull request.
Read article
- rules
Why we open-sourced the rules engine (and what stays in the catalog)
Open source static analysis rules: the Critiq engine, DSL, and 435+ OSS catalog you can run locally, inspect, and tune before CI.
Read article
- guides
Your first critiq check: reading pretty output like a senior review
Run critiq check locally: install the OSS CLI, read pretty and JSON output, and triage severity, rule IDs, and fixes like a senior review.
Read article
- guides
- security
What critiq audit secrets catches (and what it doesn't)
Secret scanning in CI with critiq audit secrets: what pattern-based detection finds, what it skips, and when to gate merges vs check.
Read article
- ci
- guides
Inline PR comments from Critiq: dedupe, severity, and noise control
Automate pull request review in GitHub Actions: inline PR comments, dedupe across reruns, and fail-on-severity merge gates with critiq-action.
Read article
- performance
- rules
Rule spotlight: performance, N+1 awaits and unbounded concurrency
N+1 and unbounded concurrency in code review: performance rules for map awaits and Promise fan-out, with fixes and CLI commands.
Read article
- rules
- security
Rule spotlight: SQL interpolation and parameterized queries
SQL injection detection in code review: how security.no-sql-interpolation flags interpolated SQL and why parameterized queries fix CWE-89.
Read article
- security
- rules
How OWASP and CWE references show up in Critiq rule metadata
OWASP and CWE rule metadata in @critiq/rules: how references keep security findings traceable in CLI JSON, SARIF, and pull request review.
Read article
- security
- rules
The most common security findings in TypeScript PRs (and the fixes)
TypeScript security code review: eight rule-backed patterns Critiq flags in PRs, with bad code, good code, and catalog rule IDs for each fix.
Read article
- rules
Correctness bugs that look fine in review
Correctness bugs in code review: nine ts.correctness rules for duplicate keys, async executors, and defects that pass a casual diff.
Read article
- rules
Change-risk signals: what testing hygiene rules are really catching
Testing hygiene and change-risk signals: merge-confidence gaps, silent skips, flaky timers, and diff-scoped coverage holes before ship.
Read article
