The GitHub AI Reviewer fighting AI Slop

IonWarp Review — PR #310

1N+1 query in user listing endpointapi/users.ts

2Unused import left after refactorutils/auth.ts

3Consider extracting shared validationforms/signup.tsx

api/users.ts

42434445

−+++

const users = await db.users.findMany();const users = await db.users.findMany({  include: { teams: true },});

N+1 query in user listing · Code Review

The listing fetches users then loops to load teams individually. Use include to fetch in one query.

IonWarp Review — PR #87

3 issues| 2 P0 1 P1

1SQL injection via template literaldb/query.ts

2Secrets in client bundleenv.config

3Missing rate limit on /authauth/login.ts

db/query.ts

424344

−++

db.query(`SELECT * FROM users WHERE id=${userId}`)db.query("SELECT * FROM users WHERE id=$1", [userId])// parameterized. no more sqli.

SQL injection via template literal · Security Review

User input interpolated directly into SQL. Use parameterized query.

IonWarp Review — PR #42

4 issues| 1 P0 2 P1 1 P2

1Modal not dismissible via Escapeauth-modal.tsx

2Focus trap missing in dropdown menunav-menu.tsx

3Touch target below 44px minimumsidebar.tsx

4Inconsistent hover state on cardstask-card.tsx

components/auth-modal.tsx

24252627

++++

useEffect(() => {  const onKey = (e) => e.key === "Escape" && onClose();  document.addEventListener("keydown", onKey);  return () => document.removeEventListener("keydown", onKey);

Modal not dismissible via Escape key · UX Review

The dialog intercepts focus but never registers an Escape handler. Keyboard-only users are trapped.

IonWarp Review — PR #422

3 issues| 1 P0 2 P1

1N+1 query — one round-trip per idapi/users.ts

2Serial await over independent fetchesapi/teams.ts

3Analytics emit awaited on the hot pathlib/track.ts

api/users.ts

14151617

−−−+

for (const id of ids) {  users.push(await db.user(id))}const users = await db.users({ where: { id: { in: ids } } })

N+1 query in the user listing · API Performance

One round-trip per id on a per-request path — the endpoint pays N database hops where a single WHERE IN serves. Batch it.

IonWarp Review — PR #256

1Click event missing on pricing CTApricing.tsx

2utm params dropped on signup redirectauth/signup.ts

3Page view fires twice on hash changeapp.tsx

app/pricing.tsx

88899091

−+

<button onClick={upgrade}>Upgrade to Pro</button><button onClick={() => { track("pricing_cta_click"); upgrade(); }}>  Upgrade to Pro</button>

CTA click missing analytics event · Analytics Review

The "Upgrade to Pro" button has no event. You will lose the pricing → signup conversion signal in PostHog.

IonWarp Review — PR #189

1Missing og:image meta taglayout.tsx

2H1 tag missing on pageblog/[slug].tsx

3Alt text empty on hero imagehero.tsx

app/blog/[slug].tsx

121314

−+

<span className="post-title">{post.title}</span><h1 className="post-title">{post.title}</h1>// single h1 per page anchors topic

H1 tag missing on page · SEO Review

Blog post title uses <span> instead of <h1>. Search engines need a single <h1>.

IonWarp Review — PR #480

3 issues| 1 P1 2 P2

1Breaking change not flaggedCHANGELOG.md

2New feature missing entryCHANGELOG.md

3Suggested release notes ready—

CHANGELOG.md

1234

++++

## [2.4.0] – 2026-05-08### BREAKING- `auth.verify()` now requires explicit algorithms array### Added

Breaking change unflagged · Changelog

auth.verify signature changed but the changelog entry sits under "Added". Consumers will miss the migration step.

IonWarp Review — PR #528

3 issues| 1 P1 2 P2

1Review turnaround p50 doubled this week—

23 PRs merged with zero review—

3Cycle-time trend attached to the report—

pr-metrics-report.md

123

+++

| metric | last week | this week || review turnaround p50 | 3.1h | 6.4h || merged with zero review | 0 | 3 |

Review turnaround p50 doubled · PR Metrics

Median first-review time went 3.1h → 6.4h this week; three PRs merged with no review at all. The trend table is attached.

IonWarp Review — PR #264

1Plan step 4 shipped with no owner or PRdocs/plans/rollout.md

2Diff contradicts the plan's stated contractlib/rollout.ts

3Unscheduled remainder not nameddocs/plans/rollout.md

docs/plans/rollout.md

3132

−+

- [ ] Step 4: migrate existing rows (owner: TBD)- [ ] Step 4: migrate existing rows — PR #265, owner named

A plan step with no owner is a step that will not happen · Plan Review

Step 4 has no owner and no PR; the diff ships the feature around it. Name the owner or name the remainder.

IonWarp Review — PR #337

1Bare catch reintroduced — 4th recurrencesync/worker.ts

2Fix shipped as opt-in flag on stored statelib/rollout.ts

3Per-instance patch; sibling sites keep the bugqueue/drain.ts

sync/worker.ts

545556

−++

try { await push(row); } catch (error) { /* dropped */ }try { await push(row); } catch (error) {  throw new PushFailed(row.id, error); // learning: swallowed-sync-error

Reintroduced a learning the team fixed three times · Repeat-Failure Learnings

This exact swallowed-sync-error shape was re-patched in #212, #260 and #291. The cached learning says: rethrow named, never drop.

IonWarp Review — PR #144

1Public API changed without docs updatedocs/api.md

2README install steps staleREADME.md

3Deleted guardrail left contradicted ruleCLAUDE.md

docs/api-reference.md

88899091

++++

### POST /v1/reviewsReturns: `{ id: string, status: "queued" | "running" }` Queues a swarm review against the given PR.

Return type undocumented for /v1/reviews · Docs Freshness

Consumers of the public API have to read source to know the return shape. Add an explicit response section.

IonWarp Review — PR #412

1Copy-paste variant of adjacent fetchUsers()api/teams.ts

2createTasksV2 kept wired "for safety"lib/tasks.ts

3Narration comments restate the diffapi/teams.ts

api/teams.ts

717273

−−+

// call the helper to get the teamsasync function fetchTeamsList(ids) { /* same body as fetchUsers */ }const teams = await fetchRows("teams", ids);

Copy-paste variant of an adjacent function · AI Slop

fetchTeamsList duplicates fetchUsers with one literal changed. Parameterize the existing helper and delete the copy.

IonWarp Review — PR #213

3 issues| 1 P0 1 P1 1 P2

1D1 write failure swallowed, returns okapi/save.ts

2Liveness probe error read as "dead"cron/sweep.ts

3Timeout fires with no distinct log linelib/client.ts

api/save.ts

88899091

−+++

} catch (error) { /* swallowed */ }} catch (error) {  log.warn({ error_code: "save_write_failed", run_id, error });  throw new SaveWriteFailed(error);

Swallowed write failure returns success · Log & Errors

The catch drops a D1 write failure and returns { ok: true } — a lost write is indistinguishable from a saved one. Log it keyed and rethrow.