Blog
Release notes, rule highlights, and engineering notes about deterministic code review.
12 articles
Featured
Critiq team
Developers use AI assistants daily but often distrust review feedback. Inspectable rules, evidence, and local checks close that gap.
Read article
Review comments should be defensible: tied to a rule, a line, severity, and references, not just confident prose.
Read article
Critiq ships the rule engine, DSL, and 435+ OSS catalog rules in the open. Here is what you get locally, what Pro adds, and how to inspect rules yourself.
Read article
Install the OSS CLI, run your first scan, and learn to read severity, rule IDs, file paths, and fix suggestions in pretty and JSON output.
Read article
An honest look at Critiq's pattern-based secret scanner: what it finds, what it skips, and when to use audit secrets vs check.
Read article
Use critiq-action for inline PR comments: dedupe across reruns, fail-on-severity gates, and when to block merge vs comment only.
Read article
How Critiq flags sequential awaits in map flows and unbounded Promise fan-out, with real rule IDs, fixes, and CLI commands.
Read article
How Critiq flags interpolated SQL in TypeScript and Java, why parameterized queries fix CWE-89, and which rule IDs to tune in CI.
Read article
Every security rule in @critiq/rules declares metadata.references, OWASP, CWE, and more, so findings stay traceable in the CLI and SARIF output.
Read article
Eight rule-backed security patterns Critiq flags in TypeScript pull requests, with bad code, good code, and the catalog rule ID for each fix.
Read article
Nine ts.correctness rules catch duplicate keys, async Promise executors, and other defects that pass a casual diff review.
Read article
Testing hygiene rules surface merge-confidence gaps, silent skips, flaky timers, and diff-scoped coverage holes, before they ship.
Read article