Nothing to paste? — a small Python API module with a planted SQL injection, a hardcoded key, a swallowed exception, an N+1 query loop and a few things done genuinely well. Or , rendered from a saved reply with no run and no charge.
Paste the code
A function, a module, a script or a diff. The quick scanner sizes it up free in your browser: language, size, and the classic pattern hits. No sign-in needed for that.
Say what you need checked
Full review, security audit, performance pass, or correctness — plus any notes. A critical finding is reported whatever the focus; the focus sets where the depth goes.
Act on the findings
A verdict that follows the findings, each finding with where it is, what breaks and the fix to apply — and what is already solid, named honestly. Copy it, or download as markdown.
What can I paste?
A single function, a whole module, a script, or a unified diff, in any mainstream language - Python, JavaScript, TypeScript, Go, Rust, Java, C#, PHP, Ruby, SQL, shell and C/C++ are all recognized. Pastes over 60,000 characters are clipped by dropping the middle and keeping both ends, and the cut is marked in the code itself so nothing disappears silently.
How are findings prioritized?
Security first, then performance, then correctness, then maintainability. A finding lands in Critical, High or Medium by its worst realistic consequence, not by its category: SQL injection, hardcoded credentials and data-loss paths are critical; unhandled errors, race conditions, N+1 queries and missing validation at a trust boundary are high; naming, duplication, dead code and missing documentation are medium.
What does the verdict mean?
One of four: Ship it (nothing critical or high), Needs fixes (high-priority findings a competent author can fix), Do not merge (at least one critical finding) or Not reviewable (the input is not code, or is too fragmentary to review honestly). The page checks the verdict against the findings and warns you when the two disagree, rather than trusting the label.
Will it invent problems that are not in my code?
It is instructed not to: every finding must point at code actually present in the paste, it may not assert runtime behaviour it cannot see, and it may not pad severity to justify a verdict. The free browser scan runs first and its pattern hits are passed in as hints to cross-check - a hit the reading of the code does not support is dropped as a false positive.
What is free, and what costs credits?
The quick scan is free, needs no sign-in, and never leaves your browser: it guesses the language, sizes the paste, and flags secret-shaped assignments, string-built SQL, dynamic execution, innerHTML assignments, swallowed exceptions, debug prints, TODO markers and long lines, each with the line numbers where it matched. The example review is also free - it renders a saved reply with no run. Only the full review calls the model, and the page shows what is reserved before you press the button.
What happens when I fix things and review again?
Reviews are saved to your SkillSafe account, so a second review of the same code is compared against the previous one: each finding is marked still here or new, resolved findings are listed, and the headline says how the verdict moved. That comparison is done in your browser from records you already have, so it costs nothing extra.
Can I drive it from a script?
Yes. The API guide shows the whole path - token, balance, estimate, run and streamed run - in cURL, Python, JavaScript, Go, Java, Ruby, PHP and C#, with the exact input fields and the reply format. The token page shows and copies the token this browser is already using.