Free forever for public OSS repos (up to 50 PRs/mo). Team at $19/dev·mo for private repos. Pro at $49/dev·mo for SOC2 + SLA.
SQL Injection leading to OS Command Execution via timeZone
twentyhq/twenty 1.7.7–1.16.7 interpolates the timeZone GraphQL variable directly into a raw SQL template literal — any …
WebSocket Upgrade Handler SSRF
Next.js WebSocket upgrade path forwards the Host header to an internal service without validation — attacker can redire…
Prototype Pollution / Sandbox Escape in vm2
vm2's object-bridge between guest and host pollutes Object.prototype via __proto__ in certain assignment patterns — att…
Free forever for public repos (up to 50 PRs/mo). Team covers private repos for growing teams. Pro adds compliance, SLA, and custom detector tuning for orgs that need it.
Public repos only. Up to 50 PR reviews/mo. All detectors. No credit card. Forever.
Private repos, unlimited PRs, custom rules, 👍/👎 dashboard, priority queue.
Everything in Team + SOC2-friendly audit logs, 99.5% SLA, custom detector tuning, dedicated Slack channel.
PullLight Team is $19/dev·mo — cheaper than CodeRabbit Pro ($24) and Snyk ($25+). Per-seat math below at common team sizes.
| Tool | Per-dev price | 5 devs/mo | 10 devs/mo | 25 devs/mo | vs PullLight at 25 |
|---|---|---|---|---|---|
| ◈ PullLight Team | $19/dev | $95/mo | $190/mo | $475/mo | — |
| CodeRabbit Pro | $24/dev | $120/mo | $240/mo | $600/mo | Save $125/mo |
| Snyk Code | $25+/dev | $125+/mo | $250+/mo | $625+/mo | Save $150+/mo |
| Copilot PR Review | ~$19/dev | ~$95/mo | ~$190/mo | ~$475/mo | + human-in-the-loop |
| Greptile | $30+/dev | $150+/mo | $300+/mo | $750+/mo | Save $275+/mo |
* Competitor pricing from public sources as of June 2026. CodeRabbit Pro $24/dev/mo, Snyk Code starting $25/dev/mo, Copilot ~$19/dev bundled in GitHub Copilot. Usage-based overages not included. PullLight Pro ($49/dev/mo) compares to Snyk Enterprise or CodeRabbit Enterprise tiers.
Free covers public repos. Team adds private repos + team tooling. Pro adds compliance, SLA, and tuning for regulated orgs.
| Feature | Free | Team $19/dev | Pro $49/dev |
|---|---|---|---|
| Custom review rules (CONTRIBUTING.md / style guide) | ✓ | ✓ | ✓ |
| Inline AI comment engine (Claude Sonnet, structured JSON) | ✓ | ✓ | ✓ |
| GitHub Check Runs + Risk Score 0–100 per PR | ✓ | ✓ | ✓ |
| Inline suggestions + one-click Fix PR creation | ✓ | ✓ | ✓ |
| Private repos + unlimited PRs | — | ✓ | ✓ |
| Slack & Discord notifications | — | ✓ | ✓ |
| CLI (npx pulllight scan — scan any branch locally) | ✓ | ✓ | ✓ |
| Custom team rules (Settings → Review Focus) | ✓ | ✓ | ✓ |
| Weekly email digest (bugs caught, risk trends) — see sample → | — | ✓ | ✓ |
| Priority webhook queue | — | ✓ | ✓ |
| 👍/👎 review-quality dashboard | — | ✓ | ✓ |
| SOC2-friendly audit logs | — | — | ✓ |
| 99.5% uptime SLA | — | — | ✓ |
| Custom detector tuning | — | — | ✓ |
| Dedicated Slack support channel | — | — | ✓ |
CodeRabbit Pro is $24/dev·mo. Snyk Code starts at $25/dev·mo. PullLight Team is $19 — and unlike those tools, nothing auto-posts to your PR without a human signing off. The review queue is the whole product: AI surfaces findings, you approve what ships. At 10 devs that's $190/mo vs $240–$250 elsewhere. At 25 devs the gap hits $125–$150/mo or $1,500–$1,800/yr. Pro at $49/dev·mo competes with Snyk Enterprise — audit logging, SLA, and detector tuning for orgs running compliance programs.
Start free on any public repo, or upgrade to Team for private repos. Cancel anytime.