The AI code reviewer teams switch to from SonarQube
Stop ignoring static analysis alerts. AI semantic review with the highest signal-to-noise of any code reviewer. Custom rules in plain English — not Java plugins or XML profiles.
$100 in free usage. No seat fees.
services/auth/session.py
def validate_session(token: str):
session = cache.get(f"session:{token}")
if session:
return json.loads(session)
return db.query_session(token)
# SonarQube: ✅ No issues found
# All rules pass
session = cache.get(f"session:{token}")
if session:
return json.loads(session)
return db.query_session(token)
# SonarQube: ✅ No issues found
# All rules pass
macroscope[bot]Bug
Cache poisoning via unsanitized token. The
token parameter is interpolated directly into the cache key without validation. An attacker can inject session:* patterns to read other users' sessions. db.query_session also receives the raw token — validate or hash the token before use in both paths.✓Valid syntax. Real vulnerability. Pattern matching sees the first. Macroscope sees both.
