Blog
Honest, dated writing on self-hosted AI code review, the CodeRabbit alternatives landscape, air-gapped deployment, and compliance-grade merge gating. Every factual claim is sourced and dated "as of July 2026" — where a competitor does something well, we say so.
-
Does PCI DSS Require Code Review? What 6.2.3 Actually Says
Yes, and unlike HIPAA it is explicit. Automated tools are allowed to perform the review, 6.2.3.1 is a branch that applies only to manual ones, and the obligation most teams underbuild is the documentation rather than the review itself.
Read the article -
HIPAA and AI Code Review: What You Actually Have to Document
HIPAA does not require code review. It requires risk analysis, audit controls and six years of documentation, and most setups fail on retention long before they fail on rigour. What the four relevant provisions actually say, and what to keep.
Read the article -
How to Run AI Code Review in an Air-Gapped Environment
The reviewer is rarely what breaks. Hidden outbound dependencies are: license checks, telemetry, registry pulls, model downloads on first run. Offline install by image tarball, upgrades without a registry, and how to verify no egress with a firewall instead of a datasheet.
Read the article -
Can You Run AI Code Review Without Sending Your Code to the Cloud?
Yes, but "self-hosted" means three different architectures and only one of them survives an air gap. What separates them, why bring-your-own-LLM is the load-bearing feature, and the six questions that eliminate options fastest.
Read the article -
What an AI Code Review Audit Trail Must Prove
A 10-item, vendor-neutral checklist for auditors and compliance owners: what change-management evidence must exist when AI reviews code — recorded reviews, reasoned gate decisions, accountable overrides, tamper-evidence, and exports — with a real hash-chained log as the worked example.
-
Wiring a Self-Hosted AI Code Reviewer into GitHub — the GitHub App Way
Why a GitHub App beats a PAT or OAuth app for a review bot — least-privilege permissions, one-hour installation tokens, org-owned credential custody — plus the full registration-to-installed walkthrough with GitHub's own docs linked at every step.
-
CodeRabbit Alternatives for Teams That Can't Send Code to the Cloud
An honest, dated comparison: what CodeRabbit does well, where its 500-seat self-host floor and checkbox-bypassable gates leave regulated teams out, fair coverage of Qodo, Bito, Sourcery, SonarQube, and Greptile, and where Gatekeep fits.
Read the article -
Self-Hosted AI Code Review: What It Actually Takes
A practitioner's guide to compliance perimeters, the auto-publish and approval-bias failure modes, the BYO-LLM landscape (vLLM/Ollama, Azure/Bedrock), and a six-point vendor checklist — with Gatekeep as the honest, worked example.
Read the article