Engineering notes from the review queue

AI code review catches 6 bug patterns that slip past human reviewers — unhandled promise rejections, TOCTOU race conditions, auth bypass via middleware logic gaps, SSRF via permissive URL parsing, prototype pollution, and path traversal via unsanitized file writes. See real CVEs inside.

Every AI code review tool today auto-posts every comment directly to GitHub. Engineers turn them off in week two because the noise drowns out real bugs. Here is what we did differently — and why the human gate is the whole point.