{
  "id": 5710720,
  "title": "The AI reviewer found a real bug. Its suggested fix would have broken my app.",
  "url": "https://urgent.news/2026/09/05/the-ai-reviewer-found-a-real-bug-its-suggested-fix-would-have-broken",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-05T03:23:50.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ko-hi/the-ai-reviewer-found-a-real-bug-its-suggested-fix-would-have-broken-my-app-1ach"
  },
  "original_language": "en",
  "account": "In a recent experiment, the author used an AI code reviewer, CodeRabbit, on a pull request generated by an AI coding agent. The reviewer found nothing on the default setting, but a strict setting uncovered a real vulnerability (CWE-1236) in the CSV export of a pricing calculator tool. The suggested fix to escape quotes and commas incorrectly would have broken all negative numbers in the exported file, as the numbers had already been processed through toFixed().\n\nThe author then adjusted the configuration to an assertive profile, which led to the generation of a committable patch that correctly escaped the vulnerable input. However, this patch failed to account for values that were already numbers, such as -1e-7, which would be converted to exponent notation and thus missed by the regex used in the fix. Ultimately, the author opted for a regex that let the language determine the type of the input, resulting in a patch that passed the strict review without any issues.\n\nThe author concludes that the AI reviewer found a real bug that would have gone unnoticed with the default setting. While the patch offered by the AI was correct, it was not entirely appropriate for this specific codebase. The author questions whether it is safe to automatically apply the AI's suggestions without manual review, given that both the AI and the reviewer disagreed on the appropriate solution.",
  "summary": "TL;DR — I put an AI code reviewer on a pull request written by an AI coding agent. On the default setting it found nothing. On the strict setting it found a real vulnerability. And the patch it offered would have quietly broken every negative number in the exported file. I ship small browser tools written by Claude Code, and I am not a good enough reviewer to catch a security bug in code I did…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}