smb06

TL;DR - CodeRabbit Secure launched several new features including runtime security validation, multi-repo security deep scans, and enforceable merge gates. We help you identify and fix hidden loopholes that could otherwise be exploited by bad-faith attackers looking for auth bypass, broken access control, SQL injection vulnerability, etc.

Disclaimer - I work at CodeRabbit

TL;DR - use CodeRabbit's defensive AI agents to run a deep-scan of your repo, identify and fix vulnerabilities for free until Nov 8th.

Hey folks - this is Sahil from the CodeRabbit team here. For anyone unfamiliar, CodeRabbit helps you with various aspects of an agentic SDLC including code review and security deep scans.

For the next two weeks we are offering free security deep scans of your repositories. All existing and new users of CodeRabbit are welcome to run a deep scan of your code to find and fix potential security vulnerabilities for free.

CodeRabbit Secure's Deep Scan runs as a semantic analysis of your codebase with a recon -> analysis -> fix kind of agentic workflow. It is intended to be a defensive mechanism to hopefully help you get a leg up before any potential vulnerabilities are exploited by bad-faith actors.

Let us know if you have any questions.

$29? So basically one half decent session to plan and half-build some moderately complex task? Per month?

Hi HN - this is Sahil from the CodeRabbit team. Just wanted to share a nice little milestone we crossed at CodeRabbit.

In the month of Sep '26, CodeRabbit delivered over 1million code reviews in open-source repos! Some interesting trends we noticed:

- The top repos by volume are newer AI/agent tooling: stablyai/orca (5.6k reviews), pingdotgg/t3code (3.9k), manaflow-ai/cmux (3.5k).

- Some established projects show up in the top 10 too: bun, vllm, pnpm, mise.

- Installed on 300k+ public repos. It's free for anyone working on public repos.

On the money side: in August we committed $10M+ (in cash and product subscription value) to open source over 12 months. About $1.3M has been counted toward it so far, per our public tracker (coderabbit.ai/oss)and we look forward to continued investment in the OSS community.

One caveat: the count includes re-reviews of the same PR, so these are review runs, not unique PRs.

Big fumble from Google / Gemini to not be able to dominate in the google drive ecosystem

I'm guessing XAI

I haven't checked the details but I suspect its more to do with not being able to prevent rogue agents from escaping their sandboxes

I expect they’ll change usage limits in some of the plans or introduce new plans with new limits

Would love to see a similar version in corporate org charts where companies have adopted "AI Employees"

This is genius.

Did you use Claude to build this?

“a prompt telling it to attack stuff” — that’s the uncontrolled or not fully understood part of the AI isn’t it? No human told the deterministic system in 2) to attack Hugging Face. The random token generator landed on a guidance for 2) that caused it while 2) in itself still remains a deterministic system.

Doesn't seem too far off for an industry that is still making its way through enterprise market segment. I'm often taken aback when I talk to engineers who are not in the silicon valley tech bubble when they say that they're still evaluating AI coding agents. Serves as a good reminder that the enterprise world outside Silicon Valley is very different.

I'm not sure if there's even a realistic pathway to keep it below 2.5C without drastic societal changes

"When platforms hardcode a single provider’s models, buyers must negotiate for leverage to be able to change it"

Tomas Tunguz's Linkedin post really spoke to me. Companies relying on a single LLM are owning much of the lock-in risk that comes with it. Multi-LLM is the new Multi-Cloud.

If so, i haven't seen any signs of this supposed crackdown. I routinely see posts where more than 60-70% of the comments are clearly bot generated and many with the tell-tale signs of LLM-speak.

>we intend to wind down our contract providing OpenAI models to Cursor, with a proposed shutoff date of November 12, 2026

Cursor's attempt at a vertical play, owning everything from the LLMs to the Git platform, is probably going to ruffle some more feathers beyond Codex.

>>Agents began to autonomously divide labor. Some investigated possible exploits, others searched for credentials, and others focused on communication or coordination. Agents offered their own expertise in exchange for help elsewhere and left requests for peers who might be better positioned to pursue a particular lead

This is the point where a human should've noticed and gotten involved

Engineers also code, they plan the system architecture, they improve what is built.

Coding is a skill-set, it’s not the only engineering job requirement.

Hey folks, I work at CodeRabbit and today CodeRabbit has announced a commitment of more than $10 million to open source projects and maintainers over the next 12 months.

This builds upon our previous commitment and includes includes cash sponsorships for OSS maintainers, free code reviews and security scans for public repos. OSS maintainers are disproportionately impacted by the increased volume of commits and we want to help you sort through them.

More info in the blog I linked above and on our website: https://www.coderabbit.ai/oss

>So more than distribution, it’s discovery, stupid. And like the content types of yore, the creator economy is going to go absolutely hog wild on vibe coded software.

Its not that people are failing to find these apps but more that they find them and still don't care.

Yeah well there will be a La Nina which will add to drought conditions so of course a wetter season with El Niño doesn't help overall

Everything has a KPI, everything is gamified, and everything becomes a competition because that's how life is at work for tech pros.

Seems like the main difference is:

- legal specific skills (contract review and redlining, legal research, etc);

- legal-specific MCP connectors

- pre-built agents from other legal software providers;

- SI/legal-tech partner list

It was first/fast to the market, well before Claude and such and it is hard to displace tools once they become entrenched in your workflows.

But can you still walk in through the front door?

Doesn't Fin cover this use case?

Former VLSI engineer here. Fab process engineering is a highly tuned artifact. You are talking about getting down to a few nanometers. You are talking less than 100 atoms at that scale. Changing anything requires reworking the whole fab to be highly tuned again. Back in my day (over a decade ago) you would run any process for months before being confident that it wasn't going to vary too much

The thing that could change is interpreting "the whole thing as generated by Claude"

I have to keep reminding it to not write a wall of text. It follows my instruction for a bit and then reverts to type. I have the instruction saved in agents.md but still have to keep reminding it.