Off-by-one, silent catches, case mismatches.
Postil reads the diff in context of the surrounding code and flags the obvious bug before a human has to.
Postil spins up on every new PR, reads the diff in context, and leaves inline comments only on the things that actually matter. Correctness. Security. The obvious bug. No drive-by style gripes.
Free while in beta · Hosted at postil.dev · source
src/auth/session.ts +8 −3
- const user = await db.query.users.findFirst({
- where: eq(users.email, email),
- });
+ const user = await db.query.users.findFirst({
+ where: eq(users.email, email.toLowerCase()),
+ });Emails were indexed case-insensitively but compared case-sensitively.
Postil doesn't dump a wall-of-text summary on your PR. It leaves targeted comments at the exact line, grouped by severity, with a short reason and a suggested patch where it has one.
- return await fetch(url).then(r => r.json());+ const r = await fetch(url);+ if (!r.ok) throw new ResponseError(r.status);+ return await r.json();
The previous code silently returned a parsed 500-response. The replacement surfaces the HTTP failure before parsing. Also consider a retry budget for idempotent GETs.
Postil reads the diff in context of the surrounding code and flags the obvious bug before a human has to.
Security patterns get opinionated treatment with direct suggestions and the reason a reviewer might object.
When a PR widens beyond its stated purpose or touches a public interface, Postil points it out so you can split or annotate.
Postil honours .coderabbit.yaml, .kodo.yaml, and its own .postil.yaml. Team conventions override defaults.
Linting, formatting, and import ordering belong in your CI — not in the reviewer. Postil stays out of their way.
One review per opened or ready-for-review PR, one per synchronize batch, capped tokens. No surprise bills.
Add the Postil GitHub App to a repo or org. Takes a minute.
Postil receives the webhook, reads the diff and the surrounding context, and works in a sandboxed worker.
Inline comments on the hunks that matter. Threads resolve as you address them.
Postil reviews code. It doesn't collect it, store it, or train on it.
Diffs are sent to the model provider only for the duration of a single review. No training, no retention on Postil servers, no resale.
Reviews run with a per-installation GitHub token that expires in an hour. Sandboxes use fresh creds per run and are torn down after.
Database and analytics run in eu-central-1. You can pick the model region on OpenRouter to keep inference on-continent.
Point Postil at your own OpenRouter, Anthropic, or OpenAI key and the diff never leaves your vendor relationship.
Prefer to run it yourself? Postil is Apache-2.0. Self-host guide →
Apache-2.0, source on GitHub, receipts kept. You can read, fork, self-host, or swap the reviewer model. Managed postil.dev is the same code, run by us.