CriticalSecurity
Tenant filter missing on export query
api/handlers/export.go:88
The new export endpoint queries invoices by id only. Every other handler in this package scopes by org_id; this one returns another tenant's data when ids are guessed.
Cost-firstFree security checks on every pull request
Code review that understands your whole codebase
MergeHarbor reviews every pull request with the context of your entire codebase, verifies each finding before posting it, and learns your team's standards. Run it in our cloud or yours, with SSO, audit logs, and a cost cap on every review.
- No credit card required
- Self-hosting available
- Your code is never used for training
Works with the code hosts you already run, in the cloud or self-managed
GitHub
Cloud · Enterprise Server
GitLab
Cloud · Self-Managed
Bitbucket
Cloud · Data Center
Azure DevOps
Services · Server
Gitea
Gitea · Forgejo
The console
See what needs attention across every repository
Critical findings, pull requests waiting on a fix, indexing progress, and spend against budget, in one place for every team.
How it works
A reviewer that does the investigation first
Diff-only tools comment on the lines that changed. MergeHarbor follows the change through the codebase, then checks its own work.
- 01
Index the codebase
MergeHarbor builds a graph of every repository — files, symbols, and call relationships — plus a semantic index, and keeps both current with each push.
- 02
Investigate the pull request
An agent reads the change, follows callers and callees across the codebase, searches for similar code, and checks history before it forms an opinion.
- 03
Verify before posting
Every finding goes through an independent verification pass that tries to disprove it. Only findings that survive are posted, with a confidence score.
- 04
Learn your standards
Plain-English rules, the CLAUDE.md and AGENTS.md files you already keep, and your team's reactions to comments shape every later review.
What it catches
The bugs that only show up when you read beyond the diff
Cross-file logic errors, missing authorization, race conditions, and data-integrity problems, each reported with the evidence behind it.
MajorConcurrency
Lock released before the shared map is updated
worker/pool.py:141
drain() releases _lock and then writes to _inflight. Two workers draining at once can drop a job. The callers in scheduler.py run drain() concurrently.
MajorData integrity
Balance update runs outside the transaction
billing/ledger.ts:212
updateBalance() is called after tx.commit(). If it fails, the ledger entry exists without the balance change; the retry in capture() then double-credits.
Illustrative findings in the format MergeHarbor posts on pull requests.
Your standards
Reviews that follow your rules, not generic advice
Set strictness, categories, and filters for the organization, override them per repository, and keep repository-specific rules in version control.
Plain-English rules. Teach a rule from the console or in a pull request with
@mergeharbor remember, scoped to the paths it applies to.Context you already wrote. CLAUDE.md, AGENTS.md, Cursor rules, Copilot instructions, and a knowledge base of design documents are read on every review.
Learning with approval. Patterns in your team's reactions become proposed rules that an admin approves before they take effect.
Tamper-resistant configuration.
.mergeharbor.ymlis read from the merge base, so a pull request cannot change how it is reviewed.
In your workflow
Feedback where your engineers already work
MergeHarbor posts on the pull request and stays out of the way. There is no new tool to check and no extra step before merging.
Inline comments with fixes
Findings land on the exact lines with a suggested change. On GitHub, one click opens a fix pull request you can merge from the console, and
every finding includes a ready-to-paste prompt for your coding agent.
Status checks and auto-approve
Block merges on critical findings or a low confidence score, and optionally approve pull requests that come back clean.
Summaries reviewers can trust
Each review opens with a summary of the change, a confidence score, and an optional sequence diagram of the new flow.
Commands in the conversation
Ask for a re-review with
@mergeharbor review, or teach a rule without leaving the pull request.
Incremental on every push
New commits are reviewed on their own, earlier findings carry forward, and findings you fixed are marked addressed.
Analytics for engineering leaders
Bugs caught by severity, review latency, time to merge, addressed rate, and an ROI report, filtered by team, repository, and author.
Predictable cost
The right depth of review for each pull request
A documentation change does not need the most expensive model. A change to payments code does. MergeHarbor decides per pull request and shows you the bill.
- Free deterministic checks on every pull request: secrets, SQL and shell injection, XSS sinks, eval, disabled TLS verification, conflict markers, and large binaries or data dumps
- One focused model pass for ordinary changes; an agentic deep review only for high-risk or cross-cutting ones
- A cost cap on every review, and monthly budgets that warn or pause before you overspend
- Cost per review, per pull request, and per developer, visible to admins
Built for enterprises
Security your review board will sign off on
Run MergeHarbor in your own cloud, connect it to your identity provider, and keep a tamper-evident record of every action.
Self-hosted or cloud
Deploy on Kubernetes with our Helm chart, or on AWS with Terraform. Use your own model accounts so code stays in your cloud.
SSO and fine-grained roles
SAML 2.0 or OIDC single sign-on with enforcement, SCIM provisioning, group-to-role mapping, and custom roles.
Tamper-evident audit log
Every change, login, and export is recorded in an append-only, hash-chained log you can verify and stream to your SIEM.
Secrets never reach a model
Keys, tokens, and credentials are stripped from code before any model, log, or archive sees them.
Isolation by design
Every request is scoped to its organization, and data from one organization is never visible to another.
Data residency
Restrict inference to US or EU regions, set retention per organization, or self-host to keep everything in your cloud.
Design partner program
Shape MergeHarbor with us
We work closely with a small group of engineering organizations on deployment, review quality, and the roadmap. Partners get direct access to the engineers building MergeHarbor and preferred pricing.
Frequently asked questions
How is MergeHarbor different from a linter or a diff-based AI reviewer?
Linters check rules on individual files, and most AI reviewers only see the lines that changed. MergeHarbor indexes your repositories as a graph of files, symbols, and calls, so the reviewer can trace a change to its callers, compare it with similar code, and read history before reporting. Each finding then passes an independent verification step before it is posted.
Which code hosts are supported?
GitHub, GitHub Enterprise Server, GitLab (including self-managed), Bitbucket Cloud, Bitbucket Data Center, Azure DevOps Services, Azure DevOps Server (2020 and later), and Gitea or Forgejo. Self-managed hosts on private networks are supported when MergeHarbor is self-hosted or can reach them.
Which languages does MergeHarbor understand?
Symbol-level indexing covers Go, Python, JavaScript, TypeScript, Java, Rust, Ruby, C#, C, and C++. Other languages are indexed for search and reviewed with the same agent, with less structural context.
Is our code used to train models?
No. Customer code is never used for training, and secrets are removed before content reaches a model. Enterprise organizations can restrict inference to US or EU regions, and self-hosted deployments can use your own model provider accounts.
Can we self-host MergeHarbor?
Yes. MergeHarbor ships as container images with a Helm chart for Kubernetes and Terraform for AWS. Self-hosted deployments support SSO, audit export, and your own model provider accounts.
How long does setup take?
Connecting a code host and choosing repositories takes a few minutes. Reviews start immediately; indexing runs in the background and adds codebase context as it completes.
Have another question? Talk to our team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.