JavaScript spans browsers, Node services, and bundled front ends. CodeCritic reviews real diffs and pasted snippets with enough surrounding context to catch async mistakes, module boundary bugs, and security seams that linters treat as style.
Review focus
Generic “looks fine” feedback is useless in JS. The model is steered toward failure modes that survive green CI: wrong async ordering, silent behavior changes after refactors, and XSS-shaped APIs.
AI review does not replace threat modeling or PCI/HIPAA sign-off. Use it as a fast second pass; owners who know deployment risk still approve merge.
Stacks
Middleware ordering, body-parser limits, auth bypass via alternate routes, and logging that prints tokens.
Client-side secret leakage, oversized bundles with dead code paths, and fetch wrappers that drop credentials mode.
Babel/SWC transforms that hide the runtime code reviewers read; source maps are not a substitute for reviewing emitted behavior.
Workflow
Sign up, open a new review, and paste a module or upload a file. For ongoing work, connect GitHub and target the PR that contains your JS changes.
CodeCritic detects language and framework cues from the snippet or diff so findings reference the stack you actually use, not generic advice.
Issues arrive grouped with short explanations. Fix blocking items first, then decide which suggestions are worth debate in human review.
When ready, enable GitHub integration so the same engine comments on pull requests your team already merges through.
How to use it
Paste flows work best with a coherent unit: a route handler plus its helpers, a React component with hooks it calls, or a service module - not three unrelated exports stripped of imports.
Linters and formatters should stay in CI. CodeCritic is aimed at reasoning: “this change can throw before the catch runs” beats “prefer const”.
For large refactors, split behavior changes from mechanical moves. Mixed diffs confuse every reviewer, automated or human.
If you ship through GitHub, connect the repository once and run reviews on the PR diff so comments sit next to the lines reviewers already discuss.
Paid tiers add API and Action automation when you want the same checks on every push, not only when someone remembers to paste.
Pair automated output with your existing test suite: AI can miss business rules that only your domain tests encode.
Details: Integrations, Limitations, Pricing.
Framework guide: React code review guide
Code patterns
Small slices from real PRs. Paste similar units in the browser or run on the GitHub diff that contains them.
Common in PRs that add async helpers without awaiting the chain.
app.post('/pay', (req, res) => {
chargeCustomer(req.body); // not awaited
res.json({ ok: true });
});export function Bio({ html }: { html: string }) {
return <div dangerouslySetInnerHTML={{ __html: html }} />;
}Sample findings
chargeCustomer returns a Promise but is not awaited. Failures become unhandled rejections and the client still receives ok: true.
Before
chargeCustomer(req.body);
res.json({ ok: true });Suggested direction
try {
await chargeCustomer(req.body);
res.json({ ok: true });
} catch (err) {
next(err);
}dangerouslySetInnerHTML with untrusted html enables stored XSS if Bio is fed user content.
Before
<div dangerouslySetInnerHTML={{ __html: html }} />Suggested direction
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />Illustrative patterns from real review categories. Your output depends on diff size, language, and context.
FAQ
Start free in the browser, then connect GitHub when the team wants reviews on every pull request.