Every pull request, reviewed in under a minute.

Nitpick reads the diff the moment it opens, comments on the exact lines that need a second look, and writes the fix so the author can apply it in one click.

Book a demo See it review a PR

For GitHub, GitLab, and Bitbucket.

quayside/storefront / pull/2184/files

Add saved carts for signed-in shoppers #2184

Openpriya-raman wants to merge 1 commit intomainfrompriya/saved-carts

src/server/routes/saved-carts.tsNew file+20

1+import { route, json } from "@/server/http";

2+import { db } from "@/server/db";

3+import type { SavedCart } from "@/types/cart";

5+// GET /api/saved-carts: carts saved for later

6+export const savedCarts = route.get(async (req) => {

7+ const userId = req.query.get("userId");

8+ const carts = await db.carts.findSaved(userId);

10+ const result: SavedCart[] = [];

11+ for (const cart of carts) {

12+ const items = [];

13+ for (const id of cart.productIds) {

14+ items.push(await db.products.get(id));

15+ }

16+ result.push({ ...cart, items });

17+ }

NitpickHighN+1 queriesL10–17

N+1 query in a loop

Each product is fetched on its own. Three carts of 12 items make 37 queries per request. Load them in one batch.

Suggested change8 lines

+const ids = carts.flatMap((cart) => cart.productIds);

+const products = await db.products.getMany(ids);

+const byId = new Map(products.map((p) => [p.id, p]));

+const result: SavedCart[] = carts.map((cart) => ({

+ ...cart,

+ items: cart.productIds.map((id) => byId.get(id)!),

+}));

Adds one commit

18+

19+ return json(result);

20+});

src/components/SavedCartsPanel.tsxNew file+20

1+import { useSavedCarts } from "@/hooks/use-saved-carts";

2+import { CartCard } from "./CartCard";

3+import { PanelSkeleton } from "./PanelSkeleton";

5+export function SavedCartsPanel() {

6+ const { data: carts, isLoading } = useSavedCarts();

8+ if (isLoading) return <PanelSkeleton rows={3} />;

10+ return (

11+ <section aria-labelledby="saved-title">

12+ <h2 id="saved-title">Saved for later</h2>

13+ <ul className="cart-grid">

14+ {carts.map((cart) => (

15+ <CartCard key={cart.id} cart={cart} />

16+ ))}

17+ </ul>

18+ </section>

19+ );

20+}

Reviewing pull requests at

What it catches

Six rules, each one a switch.

Every finding is tied to the rule that raised it. Turn a rule off and the review below changes with it, the same way it would on your own pull requests.

Review rules6 of 6 on

northbeam/dispatch Export shipments as CSV #911Nitpick6 findings

src/routes/shipments/export.ts+27

1+import { Router } from "express";

2+import { db } from "../db";

3+import { putObject } from "../storage";

4+import { toCsvRow } from "./csv";

6+const BUCKET_KEY = "nbf_live_9f2c41d7e8a3b6c0";

Live storage key in sourceHigh

Move it to a secret and rotate it. It is already in this branch’s history.

Secrets in code

8+export const router = Router();

10+router.post("/shipments/export", async (req, res) => {

New route has no testLow

Nothing in test/ calls POST /shipments/export.

Missing tests for new routes

11+ const shipments = await db.shipment.findMany({

12+ where: { accountId: req.body.accountId },

accountId is taken from the request bodyHigh

No session check, so any caller can export any account’s shipments.

Missing auth checks

13+ });

14+

15+ const rows = [];

16+ for (const s of shipments) {

17+ const carrier = await db.carrier.find(s.carrierId);

One carrier query per shipmentMedium

An export of 2,000 shipments runs 2,001 queries. Fetch carriers once.

N+1 queries

18+ rows.push(toCsvRow(s, carrier));

19+ }

20+

21+ const url = await putObject(BUCKET_KEY, rows.join("\n"));

Upload failure isn’t handledMedium

If putObject rejects, the request hangs until it times out.

Unhandled errors

22+ res.json({ url });

23+});

24+

25+function legacyHeader() {

legacyHeader is never calledLow

No references anywhere in the repo. Safe to delete.

Dead code

26+ return "id,carrier,eta,status";

27+}

Start to merge

Thirteen minutes from opened to merged.

The same pull request, played back step by step.

Scroll to move the clock ↓

10:02:14

+00:00 since opened

10:02:14Opened
10:02:52Reviewed
10:09:30Fixes pushed
10:14:05Approved
10:15:41Merged

Priya opens #2184

Forty new lines across a route and a component.

OpenAdd saved carts for signed-in shoppers #2184NitpickReviewing

10:02:14priya-raman opened this pull request
10:02:52nitpick reviewed: 3 issues, 2 suggested fixes
10:09:30priya-raman pushed 1 commit: apply suggestions, add empty state
10:14:05tomas-ferreira approved these changes
10:15:41priya-raman merged commit a3f9c1e into main

src/server/routes/saved-carts.ts

5+// GET /api/saved-carts: carts saved for later

6+export const savedCarts = route.get(async (req) => {

7+ const userId = req.query.get("userId");

8+ const carts = await db.carts.findSaved(userId);

10+ const result: SavedCart[] = [];

11+ for (const cart of carts) {

12+ const items = [];

13+ for (const id of cart.productIds) {

14+ items.push(await db.products.get(id));

15+ }

16+ result.push({ ...cart, items });

17+ }

18+

19+ return json(result);

Waiting for checks to finish.

10:02:14Opened
Priya opens #2184
Forty new lines across a route and a component.
priya-raman opened this pull request
10:02:52Reviewed
Nitpick reviews it in 38 seconds
Three comments on the exact lines. Both high-severity ones carry a fix.
nitpick reviewed: 3 issues, 2 suggested fixes
10:09:30Fixes pushed
Both suggestions applied
Priya applies the two fixes and adds the empty state. One commit.
priya-raman pushed 1 commit: apply suggestions, add empty state
10:14:05Approved
Approved by Tomás Ferreira
A human reviewer reads a smaller, cleaner diff and signs off.
tomas-ferreira approved these changes
10:15:41Merged
Merged into main
Checks are green and nothing is left to nitpick.
priya-raman merged commit a3f9c1e into main

Fits your workflow

Comments land where your team already reviews.

Install Nitpick on GitHub, GitLab, or Bitbucket, in the cloud or on your own instance. It comments in the thread, posts a check, and reads its rules from a file in your repository.

01Review comments on the exact lines, in the thread your team already reads.
02A check that passes once nothing high-severity is left.
03Rules in a YAML file, reviewed like any other change.

GitHub App · Cloud and Enterprise Server

PRpriya-raman opened pull request #2184· Add saved carts for signed-in shoppers

src/components/SavedCartsPanel.tsxL13–17

13+ <ul className="cart-grid">

14+ {carts.map((cart) => (

nitpickbotLow38s after opening

Empty state isn’t handled

A shopper with no saved carts sees a heading over an empty list. Show a short message and a link back to the catalog.

Check runNitpick review · 1 low-severity issue, nothing blocking

.nitpick.ymlReviewed like any other change

1# .nitpick.yml2version: 134review:5  on: [opened, synchronize]6  min_severity: low7  suggest_fixes: true89rules:10  n-plus-one: on11  missing-auth: on12  unhandled-errors: on13  secrets: { severity: high, block_merge: true }14  route-tests: { paths: ["src/routes/**"] }15  dead-code: off1617ignore:18  - "**/*.generated.ts"19  - "vendor/**"

Security

Your code is read, never kept.

Nitpick needs a diff for about a minute. It holds it in memory for that long and no longer.

01
Never stored or used for training
Diffs stay in memory for the length of a review and are discarded when the comments post. Model calls run with zero data retention.
02
SOC 2 Type II
Audited every year by an independent firm. The latest report is available under NDA.
03
Single-tenant option
An isolated deployment with its own encryption keys and network, on the Enterprise plan.
04
Data residency in the US or EU
Reviews run in Virginia or Frankfurt, and code never leaves the region you choose.

Where your code goes during a review

In numbers

Median time from opened to first review: 38s
Of suggested fixes applied by the author: 61%
Pull requests reviewed so far: 4.2M

Across all customers. Median and apply rate over the last 90 days.

From engineering leads

“Our senior engineers stopped leaving the same five comments on every pull request. Nitpick leaves them in the first minute, with the fix attached, and people apply it.”

Hannah Okafor, Director of Engineering, Northbeam Freight

“The auth rule caught a route that would have served patient records to anyone with the URL. It was in staging for eleven minutes.”

Daniel Reyes, Head of Platform, Halcyon Health

“It is quiet. Three comments, not thirty. So when Nitpick flags something, the team actually reads it.”

Mei Lindqvist, Engineering Manager, Orrery

Pricing

Priced per author, not per seat.

An author is anyone who opens a pull request in a month. Reviewers, approvers, and bots are free.

Team

$24per author / month

For teams that want every pull request reviewed.

Unlimited repositories
All six review rules
One-click suggested fixes
GitHub, GitLab, and Bitbucket Cloud

Book a demo

Business

Most teams

$40per author / month

For companies with an identity provider and auditors.

Everything in Team
SSO with SAML or OIDC
Audit log with export
Self-managed GitLab and Bitbucket Data Center

Book a demo

Enterprise

Talk to us

For security reviews, regions, and isolation.

Single-tenant deployment
US or EU data residency
Security review and DPA
A named support engineer

Book a demo

See Nitpick review your own code.

Thirty minutes with an engineer from our team. We install it on a repository you choose and review your last ten pull requests together.

No code leaves your region
Set up in about five minutes
Free for 14 days after the call

Every pull request, reviewed in under a minute.

Add saved carts for signed-in shoppers #2184

Missing auth check on a new route

N+1 query in a loop

Empty state isn’t handled

Missing auth check on a new route

N+1 query in a loop

Empty state isn’t handled

Six rules, each one a switch.

Thirteen minutes from opened to merged.

Priya opens #2184

Nitpick reviews it in 38 seconds

Both suggestions applied

Approved by Tomás Ferreira

Merged into main

Priya opens #2184

Nitpick reviews it in 38 seconds

Both suggestions applied

Approved by Tomás Ferreira

Merged into main

Comments land where your team already reviews.

Your code is read, never kept.

Never stored or used for training

SOC 2 Type II

Single-tenant option

Data residency in the US or EU

In numbers

From engineering leads

Priced per author, not per seat.

Team

Business

Enterprise

See Nitpick review your own code.