Blame
Review

Catch bugs before they ship
Blame checks every change before it reaches your customers.

Blame Review hero background
GitHub Pull Request
B
blame-appbotreviewed 1 hour ago
server/services/webhooks/dispatcher.ts
+1-1
52const signature = createHmac('sha256', secret).update(payload).digest('hex');
53-if (signature === headerSignature) {
53+if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(headerSignature))) {
54 return dispatchEvent(event);

Timing attack vulnerability in webhook signature verification

String comparison (===) returns early on the first mismatched byte, exposing the endpoint to side-channel timing analysis. Compare HMAC signatures in constant time with crypto.timingSafeEqual.

HK
hkontejust now

good catch on the timing vulnerability! updated with constant-time comparison.

Catch subtle logic flaws and security risks
Line-by-line reasoning across your full repository context before merge.

Blame Code Diff background
blame-appbotrevieweda few minutes ago
blame-appbotleft a comment

Blame reviewed changes in the commit range b76c8fa...63debb2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as review comments.

blamebotreviewed just now
src/auth/validateToken.ts
+2-1
18-if (token.exp > Date.now()) {
18+const nowSeconds = Math.floor(Date.now() / 1000);
19+if (token.exp > nowSeconds) {
20 return { valid: true };

Unit mismatch: JWT expiration claim in seconds vs milliseconds

JWT expiration timestamps (exp) are encoded in Unix epoch seconds, whereas Date.now() returns milliseconds.

Comparing them directly causes valid tokens to be marked as expired immediately. Convert Date.now() / 1000 before evaluating expiration.

Ship with total confidence
Automated check validations and high-signal code feedback before you squash and merge.

Automated check validations

Continuous CI testing and graph contract verification before squash and merge.

IA
iliasabs7 minutes ago
update: fix issue removing overlapping routes
BIA
iliasabscommitted fix1f1473b
All checks have passed
3 successful checks
CI / test (vitest)
CI / typecheck (tsc)
BBlame Review

High-signal inline feedback

Precise vulnerability and logic annotations with verified patches directly in your PR thread.

B
blamebotreviewed just now
services/webhooks/dispatcher.ts
+2-1
24export async function dispatch(url: string, data: EventPayload) {
25- return await fetch(url, { method: 'POST', body: JSON.stringify(data) });
25+ const safeTarget = await assertPublicEndpoint(url);
26+ return await fetch(safeTarget, { method: 'POST', body: JSON.stringify(data) });

Blocked SSRF vulnerability against internal VPC endpoints and cloud instance metadata (169.254.169.254).

IA
iliasabsjust now

got it, merging that now!

Total control over your codebase
Customize repository scope, trigger conditions, and workspace-level rules.

Repository indexing & reviews

Choose exactly which repositories get indexed and automatically reviewed on pull requests.

Repositories4
org/acme-corp
acme-corp/frontend
Active
acme-corp/api-gateway
Indexing...
acme-corp/billing-service
Active
acme-corp/docs
Disabled

Custom rules & invariants

Blame automatically respects your team's style guides, AI rules, and architectural invariants.

.cursorrules
---
description: Payment Webhook & Idempotency Rules
globs: lib/stripe/**/*, components/blocks/payment/**/*
---
# Webhook Retry Invariants
## Rules
-All webhook handlers must acquire a distributed Mutex lock on event_id
-Enforce idempotency via processed_events table before state mutations
-Exponential backoff jitter required for all Stripe API retries (max: 5 attempts)
-Failures must emit PaymentFailedEvent to the telemetry queue
-Never mutate transaction state without an active database transaction scope

Inside the review engine
Deep architectural analysis and invariant verification behind every pull request.

Confidence scores & pass/fail

Know exactly how safe a pull request is to merge at a glance with strict 0–5 risk scoring.

AST callers & dependency traversal

Traces downstream consumers, implementations, and circular imports beyond modified lines.

Rule files & invariant enforcement

Auto-discovers project conventions from .cursorrules, CLAUDE.md, and workspace memory.

High-level PR summary

Get a clear, structured overview of key behavioral changes without reading raw diff noise.

One-click suggested fixes

Address issues directly in GitHub with ready-to-commit patches and agent prompts.

Reply & chat in PR comments

Reply to any finding inline to ask follow-up questions, debate trade-offs, or re-trigger checks.

Questions & Answers

Start catching bugs in your pull requests today