Public proof, without repository uploads
See what the review can actually prove.
Agent PR X-Rays are static exports from completed local reviews. Every example keeps failed, waived, missing, and unverified stages visible instead of polishing them into a green badge.
Reviewed examples
Benchmark ground truth · static HTMLSQL injection in a TypeScript lookup
The lookup builds SQL with user-controlled email input instead of a parameterized query.
critical
source.ts:13Data race on a shared Go map
Multiple goroutines read and write the same map without a mutex or another synchronization boundary.
high
source.go:14Path traversal in a Python file handler
The requested filename is joined to the storage root without canonical containment validation.
high
source.py:9