# Critiq

Critiq is an open source deterministic static analysis CLI and public rule catalog for developers who want clear, actionable code review feedback.

## Pages

- /index.md: Open-source CLI and rules catalog for automated code review and pull request checks. Run deterministic security and quality checks locally or in CI.
- /about.md: Critiq builds deterministic, inspectable code review tools for AI-assisted development. Open source rules you can read, test, and tune locally or in CI.
- /blog.md: Engineering notes on deterministic code review, pull request workflows, security rules, and OSS updates from the Critiq team.
- /faq.md: Answers about the Critiq OSS CLI, local code review scans, pull request checks, documentation, and what ships today.
- /changelog.md: Product updates for the Critiq CLI, rules catalog, and GitHub Action. Release notes for deterministic code review tools.
- /integrations/github-actions.md: Add automated pull request review with inline comments. Install the CLI on your runner, run deterministic checks, and gate merges on severity.
- /contact.md: Contact Critiq for code review support, CLI help, and rule catalog feedback. Email the team or open a GitHub issue for engine bugs.
- /privacy-policy.md: How Critiq handles information collected through critiq.dev, docs.critiq.dev, and related public website interactions.
- /terms-of-service.md: The terms that govern access to the public Critiq website, linked public documentation, and other public web content we operate.
- /products/oss.md: Run npx critiq check to analyze diffs locally or in CI. Get rule-backed code review feedback on security, correctness, and performance before you merge.
- /pricing.md: Free OSS CLI and code review today. Compare planned team pull request review tiers, premium depth, and enterprise governance.
- /compare.md: Honest comparisons of Critiq vs SonarQube, Copilot code review, and other pull request review tools. Open source rules vs AI and enterprise SAST.
- /compare/sonarqube.md: Compare Critiq and SonarQube for pull request code review. Inspectable OSS rules vs mature quality gates, coverage metrics, and enterprise SAST breadth.
- /compare/copilot-code-review.md: Compare Critiq and GitHub Copilot code review for pull requests. Inspectable OSS rules vs AI-generated review comments you cannot reproduce locally.
- /blog/automate-pr-review-checks-github-actions.md: Automate PR review checks with critiq-action: diff scans, inline comments, severity gates, and reusable workflows on every pull request.
- /blog/integrate-critiq-github-workflow.md: Integrate Critiq in your GitHub workflow: local checks, pull_request scans, branch protection, and monorepo paths with critiq-action.
- /blog/linting-vs-rule-based-code-review.md: Compare linting vs rule-based code review: style and syntax from ESLint and friends, security and correctness from inspectable Critiq rules.
- /blog/rule-based-vs-ai-code-review.md: Rule-based vs AI code review: stable rule IDs and local reproduction vs fluent PR summaries that shift between runs.
- /blog/why-open-sourced-rules-engine.md: Open source static analysis rules: the Critiq engine, DSL, and 435+ OSS catalog you can run locally, inspect, and tune before CI.
- /blog/evidence-over-vibes-code-review.md: Evidence-based code review ties findings to a rule, line, severity, and references, not confident prose or AI vibes on the pull request.
- /blog/correctness-bugs-in-review.md: Correctness bugs in code review: nine ts.correctness rules for duplicate keys, async executors, and defects that pass a casual diff.
- /blog/common-typescript-security-findings.md: TypeScript security code review: eight rule-backed patterns Critiq flags in PRs, with bad code, good code, and catalog rule IDs for each fix.
- /blog/your-first-critiq-check.md: Run critiq check locally: install the OSS CLI, read pretty and JSON output, and triage severity, rule IDs, and fixes like a senior review.
- /blog/owasp-cwe-rules-metadata.md: OWASP and CWE rule metadata in @critiq/rules: how references keep security findings traceable in CLI JSON, SARIF, and pull request review.
- /blog/rule-spotlight-n-plus-one-concurrency.md: N+1 and unbounded concurrency in code review: performance rules for map awaits and Promise fan-out, with fixes and CLI commands.
- /blog/rule-spotlight-sql-interpolation.md: SQL injection detection in code review: how security.no-sql-interpolation flags interpolated SQL and why parameterized queries fix CWE-89.
- /blog/inline-pr-comments-dedupe-severity.md: Automate pull request review in GitHub Actions: inline PR comments, dedupe across reruns, and fail-on-severity merge gates with critiq-action.
- /blog/critiq-audit-secrets.md: Secret scanning in CI with critiq audit secrets: what pattern-based detection finds, what it skips, and when to gate merges vs check.
- /blog/trust-gap-ai-assisted-coding.md: AI code review vs rule-based review: why developers distrust PR bots and how inspectable rules, evidence, and local checks close the gap.
- /blog/testing-hygiene-change-risk.md: Testing hygiene and change-risk signals: merge-confidence gaps, silent skips, flaky timers, and diff-scoped coverage holes before ship.

## External docs

- https://docs.critiq.dev/: Dedicated documentation site for installation, configuration, CLI reference, rule authoring, and the OSS rules registry.

## Product pages

- /products/oss.md: Run npx critiq check to analyze diffs locally or in CI. Get rule-backed code review feedback on security, correctness, and performance before you merge.

## Sources

- Website source: critiq-cloud/apps/web/src
- Docs source: critiq-cloud/apps/docs/src
- CLI source: critiq-core/apps/cli/src/main.ts
- Rule catalog source: critiq-rules/libs/rules/catalog/catalog.yaml