AI code review · by Moonlight Devs
AI code review that finishes before your coffee does.
Diffnix runs PRInspector, an AI agent that reviews every pull request in under five seconds and catches security flaws, leaked secrets and architecture drift before they merge.
*Average review time as published by Diffnix.
Overview
Code review is where quality is decided, and it is usually the slowest step in shipping. Diffnix removes the wait. The moment a pull request is opened, its AI agent PRInspector reads the diff, understands the intent of the change and posts precise inline feedback, typically in under five seconds.
Unlike a linter, PRInspector performs deep semantic analysis. It recognises SQL injection paths, cross-site scripting, authentication bypasses and hard-coded credentials, and it understands cross-file dependencies so it can explain the real impact of a change in plain words instead of a bare rule ID.
Teams encode their own conventions as plain-English rules ("flag console.log in production code"), start from curated bundles such as Security First, and switch rules on per repository or per branch. Leaked secrets are marked Critical and fail the PR status check, so GitHub branch protection can stop them from ever merging.
Privacy is not an add-on. Diffnix runs its language models on self-hosted infrastructure, never sends source code to third-party AI providers and retains zero source code once a review completes. Enterprise teams can go further and run the models entirely on their own hardware.
- const secret = process.env.STRIPE_KEY;+ const secret = "sk_live_51Hx...9Qa";+ db.query(`SELECT * FROM users WHERE id=${id}`);Features
Real-time webhooks trigger PRInspector the instant a PR opens, so reviewers start from a clean, pre-checked diff.
Understands what the code is meant to do and how it affects other files, so it catches logic and architecture problems that pattern-matching tools miss.
Flags SQL injection, XSS, authentication bypass and insecure patterns with explainable, context-aware suggestions.
Context-aware detection of API keys, tokens and passwords that ignores env var names and example files, then fails the check.
Describe a convention in a sentence and it is enforced on every pull request. Includes a built-in rule library.
Apply different rule sets to main, release and feature branches so strictness matches risk.
Accept a suggested fix straight from the review and move on. No copy-pasting patches.
Quality-score trends, violation heatmaps, review velocity and exportable reports for leadership.
No third-party AI providers, zero code retention, TLS everywhere, plus on-premise models for Enterprise.
How it works
Install Diffnix on GitHub, GitLab or Bitbucket and pick your repositories. Setup takes about two minutes.
Enable a bundle like Security First or write your own rules in plain English.
PRInspector analyses the diff and posts inline comments and a pass/fail status within seconds.
Use cases
Built for engineering teams, open-source maintainers, tech leads & reviewers, security-conscious startups.
Hard-coded keys and JWT secrets are flagged Critical and fail the status check, so branch protection blocks the merge.
Senior engineers stop repeating the same comments; PRInspector enforces the basics so humans focus on design.
Maintainers get instant first-pass review on community contributions, even on the free plan.
Quality scores, heatmaps and velocity reports turn code review into measurable engineering health.
Compare
Diffnix does not replace human judgement or your linter. It covers what sits between them.
| Criteria | Diffnix | Manual review only | Linters & static analysis |
|---|---|---|---|
| Time to first feedback | Under 5 seconds | Hours to days | Seconds |
| Understands intent & cross-file impact | Yes, semantic AI | Yes, when time allows | No, pattern rules only |
| SQL injection, XSS & secrets | Built in, flagged Critical | Depends on the reviewer | Partial, rule-based |
| Team-specific rules | Plain English | Tribal knowledge | Config files & plugins |
| Code privacy | Self-hosted, zero retention | Stays in the team | Usually local |
| Cost to start | Free (3 repos) | Engineer hours | Free to paid |
Pricing
Start free on up to 3 active repositories. Pro unlocks unlimited repositories and AI auto-fix; Enterprise adds on-premise, local LLMs.
$0/month
$19/month
Free during early access
Custom
Official resources
Learn more
AI code review explained: how AI agents analyse pull requests, what they catch that linters miss (SQL injection, XSS, leaked secrets), how to protect code privacy and how to roll it out.
Read the guide →FAQ
Diffnix is an AI-powered code intelligence platform built by Moonlight Devs. Its agent, PRInspector, automatically reviews pull requests for security vulnerabilities, leaked secrets, code quality and team standards.
Diffnix integrates with GitHub, GitLab and Bitbucket, supports GitHub branch protection through PR status checks, and works alongside editors like VS Code.
No. Diffnix runs self-hosted language models, never shares source code with third-party AI providers and keeps zero source code after a review. Enterprise customers can run local LLMs on-premise.
The Free plan covers up to 3 active repositories with unlimited custom rules. Pro is $19 per month (free during early access) for unlimited repositories and AI auto-fix. Enterprise pricing is custom.
Yes. Describe a rule in plain English and PRInspector enforces it on every pull request. You can also start from built-in bundles such as Security First and enable rules per repository or branch.
More from Moonlight Devs
Definitive answers. Curated, verified, instant.
FaqVault is an AI-powered intelligence vault of 4,500+ curated, verified answers across 30+ categories. You can search it by meaning instead of exact keywords, and it is free for everyone.
Stop sending cryptic deploy URLs.
DomainDock (Digital WebHost) gives every project a clean, professional custom domain with automatic SSL, instant routing and managed DNS. It goes live in under 30 seconds and is free forever.
Get in touch
Talk to the Moonlight Devs team about features, partnerships or integrations.
Hard-coded live secret detected in
webhook.ts:14. Move it to an environment variable.Possible SQL injection: use a parameterised query for
id.