Find what’s hiding in your code.
Findings you can trace. A clear place to start.
Focus with the keyboard to pause. Use the left and right arrow keys to read other findings. Automatic cycling resumes when you leave.
export async function login(Check the verdict before creating a session.
Your past fixes are lessons worth keeping. In a tailored engagement, we use your commit history to find recurring mistakes, turn them into deterministic checks, and help your team enforce them in CI.
Require the right validation. Enforce architectural boundaries. Check resource obligations.
The fixes your team has already made.
Recurring mistakes become rules.
Same code and rules. Same result.
Your standards, checked with each change.
Custom checks that follow values, calls, and resources across your codebase.
term = requestSave the untrusted search term.
term = jobsRead it later in a worker.
def search(Build SQL from the same value.
A first pass for patterns that make code break, slow down, or become harder to work with.
Spot repeated I/O, parsing, compilation, and process spawning that may waste work. Verify the runtime impact in context.
Source languages JavaScript, TypeScript, Python, Java, Rust, Go, Ruby, C, C++, PHP, Scala, C# and Kotlin.
Go deeper when you need to decide what happens next.
SlopCop reads your source. It doesn’t run your code, build it, or install its dependencies. Private access uses a read-only GitHub App connection to the repositories you select.
Quick review explains selected analyzer findings using structured evidence and bounded source excerpts around matches. Deep review also examines a bounded selection of source, project documentation, architecture samples, and available recent commit metadata. It does not read the entire repository or its full history.
AI claims must reference supplied evidence. Invalid citations are rejected. That makes claims traceable; it does not prove the diagnosis or a proposed fix is correct. Quick analyzer findings remain available if AI interpretation is unavailable.
Not always. Some checks are heuristic. Treat findings as candidates to verify, and use source context and coverage notes to assess them. Reports show skipped work and incomplete results. A clean report is not a guarantee of defect-free code, and suggested fixes still need validation.
Yes. Authorize with GitHub and choose which repositories the SlopCop GitHub App can access. Repository contents and metadata are read-only.
Complete a quick review, then request a deep review from its report. Provide your email and follow the confirmation step to start it. Deep review adds checks and context, with prioritized next steps when the evidence supports changes.
Anyone holding a valid report-access link can view its report. These links are unlisted, but access is not restricted to your GitHub collaborators. Treat the link as sensitive, especially for private code.
Credential-check matches are reported by location without the matched value. Files flagged by those checks are excluded from source excerpts, including excerpts supplied to the model. Detection is bounded: this does not guarantee that every secret is found or that unflagged material is secret-free.
Custom checks and CI setup are a separate, contracted engagement. We work with your team to turn recurring fixes from your commit history into deterministic checks and integrate them into your CI. Quick and deep reviews don’t automatically create that system.
SlopCop runs Brokk’s open-source Bifrost analyzer. Deterministic checks produce candidate findings. AI explains selected evidence; deep review can also identify behavioral issues from the supplied source excerpts.
Your next review starts with a repository URL.