Skip to the content
NarratorBook a call

WorkReviewApril 2026

A security review the founder agreed with

The founder of an open-source coding tool asked what we thought of it. Four days later we sent him a three-page review with five findings.

The problem

More code is now written by AI tools, and it gets written faster than people can check it. git-lrc is an open-source tool that reviews code at the moment a developer saves it into the project. A tool like that sits on the developer's own computer and sends code out for review, so people need to trust it before they install it.

What we did

  • Read the project's code and documents: the README, the security notes, the install scripts, the hook templates, the local review page, the update flow and the release notes.
  • Ran the released Windows program (v0.2.2) in a sandbox. We installed it in a test project, checked that it blocks a commit, tried the skip path, and captured what the tool sends out by pointing it at a fake local review server.
  • Wrote down what the review did not cover, so the founder knew where our evidence stopped.
  • Sent a three-page report on 28 April 2026 with five findings, a recommended fix for each, and a suggested pilot of one repo, three developers and two weeks.
  • We used AI tools during the review.

What came of it

  • The founder confirmed that the first finding was real and said he would fix it.
  • The report's verdict: worth a pilot, not ready for broad rollout.
Findings

The five findings

  1. Local review page exposure

    On Mac and Linux, the tool's review page could be reached by other devices on the same network while it showed "localhost". That page has buttons that change things, such as commit and skip.

    Found by reading the code. Confirmed by the founder.

    Severity: High

  2. Release and install trust

    The Windows download matched its published checksum, but Windows reported it as unsigned. The user has less proof of who made the file.

    Severity: High

  3. Hook recovery gap

    Blocking a commit worked. When Git for Windows could not start the hook, the off switch did not bring the project back. Uninstalling the hook locally did.

    Severity: Medium

  4. Automation output is mixed

    When asked for output a script can read, the tool could still open screens meant for a person, and the output had human text mixed in.

    Severity: Medium

  5. Privacy clarity and payload preview

    In the tested path the tool sent the project name and a zip holding only the changed lines. Changed lines can still contain passwords or personal data, and the user gets no preview of what is sent.

    Severity: Medium

What the review did not cover

  • The install scripts were read, not run.
  • The Go test suite was not run.
  • The hosted review service was not checked.
  • Mac and Linux behaviour was read from the code. The program was run on Windows only.

Verdict in the report: worth a pilot. Not ready for broad rollout.

More work

See pricing
Contact

Stop doing work AI can do.

Book a free 30-min call

Soham UmapYou talk to Soham Umap directly.

Free call. No pitch. Projects start at $300.

What do you want off your plate?