Coduck

Free, local code review tailored to your stack, in your terminal.

Review your own branch before you push, or the PR you’ve been asked to approve. Nothing is posted automatically. You decide what’s worth a comment.

Free forever. No account, no GitHub app, no admin to ask.

Supported today

JavaScript
TypeScript
Python
React

On the way

Vuesoon
Angularsoon
Gosoon
Javasoon

Supported languages 4 + more

Checked every run

✓Product requirements
✓Security
✓Architecture
✓Backward compatibility
✓Business logic
✓DRY
✓Accessibility

code-review

$coduck review --base main \--ticket https://acme.atlassian.net/browse/ENG-482

REQUEST CHANGES  2 to fix, 2 should fix
Must Fix  Widget renders mock data, not real data
src/components/dashboard-widget.tsx:8
Should Fix  No empty state for new users
Nit      Avatars loaded from a third-party host

It knows what it doesn’t know.

Which is the only reason anybody leaves a reviewer switched on.

It asks instead of asserting

A confident wrong comment teaches people to ignore the bot. When the code and the ticket disagree, coduck does what a senior reviewer does. It asks.

src/components/dashboard/progress-widget.tsx

15- const { data, isLoading } = useUserProgress(userId)

15+ const data = SAMPLE_TASKS

coduckQuestion

SAMPLE_TASKS renders for every user. ENG‑482 asks for the signed‑in user’s own progress. Is the endpoint not landed yet?

maya

/v2/progress ships Thursday, placeholder until then.

resolved

scenes/settings/organization/OrgEmailPreferences.tsx

21 disabled={isRestricted || !currentOrganization}

23+ disabledReason={!isRestricted ? 'You need to be an admin…' : undefined}

“Adds a disabled reason so a regular member knows why they can’t toggle the setting.”

coduck Pushback

The line above uses isRestricted. This one negates it, so the reason goes to admins instead, and the toggle is now disabled for everyone.

Real finding on PostHog #22766. A PostHog reviewer caught the same thing.

It pushes back on the claim

A pull request description tells you what a change is meant to do, and reviewers tend to take it at its word, because checking is work. Coduck checks. When the code does something other than what the description claims, it says so and shows the mechanism.

It proves the bug before it reports it

When coduck is sure, it does not just say so. It writes a test that fails on your branch, then re‑runs the same test against the fix. A failing test is not an opinion you have to argue with.

progress-widget.test.tsx written by coduck

✗ FAIL on this branch

› renders the signed‑in user’s own progress

expectedtasks for user_8123

receivedSAMPLE_TASKS

✓ PASS after the fix

same test, re‑run once useUserProgress was restored

Nothing is posted without you

Findings land in your terminal. What becomes a PR comment is your call, every time.

Judged against your standards

Your ADRs, your AGENTS.md, your security notes, not a vendor’s defaults.

Tailored to your stack

Backend and frontend security are different documents. It loads the ones your frameworks need.

What a real review looks like.

This mirrors an actual Coduck review, with the file paths and specifics swapped for a generic example.

REQUEST CHANGES 2 to fix, 2 should fix, 1 nit

	found	must fix	should fix	nits
product	2	1	1	0
architecture	1	0	1	0
security	1	0	0	1
correctness	1	1	0	0

product

Must FixWidget renders mock data, not user progress

src/components/dashboard/progress-widget.tsx:8

Every user sees the same fixed example data instead of their own progress, so the ticket's acceptance criteria can't hold for anyone.

Should FixNo empty state for new users

src/components/dashboard/progress-widget.tsx:66

A user with nothing in progress still sees a full task list and sample data, the one case the ticket calls out.

architecture

Should FixComponent duplicated in two places

src/components/dashboard/task-row.tsx:1

This file is a byte-for-byte copy of one already in the admin view, so every future fix has to be made twice.

security

NitAvatars loaded from a third-party host

src/components/dashboard/user-avatar.tsx:13

Every dashboard load sends a visitor's IP address to an external image host, just for a placeholder avatar.

correctness

Must FixExisting dashboard removed for some users

src/pages/dashboard/page.tsx:12

Users outside one role lose the dashboard they had, replaced by the new widget. The ticket asked for an addition, not a swap.