The first OpenEnv environment for real-world code review. 13 tasks, 6 languages, dense rewards, deterministic grading.
Scores achieved by Gemini 2.0 Flash on each task — used as the reference baseline.
📄 utils/statistics.py
📄 auth/user_manager.py
📄 core/rate_limiter.py
Interact with the environment in real time. Select a task, start a review, and submit your findings.
Three simple steps to train an AI code reviewer.
Start a new episode. Pass a task ID and receive the full code diff, file name, PR title, and max steps allowed.
Submit your review comments and verdict. Receive a dense reward signal, done flag, and info about remaining steps.
When done, grade the full episode. Receive a deterministic score from 0.0 to 1.0 based on detected issues and verdict accuracy.
Paste any code — get instant AI feedback
From simple edge-case bugs to subtle concurrency nightmares.
utils/statistics.py
Review a Python utility module. Find edge-case bugs and performance issues hidden in seemingly functional code — empty-list crashes and O(n²) lookups.
auth/user_manager.py
Analyze an authentication module riddled with security holes — SQL injection, hardcoded secrets, broken crypto, and dangerous deserialization.
core/rate_limiter.py
Hunt subtle race conditions, silent exception swallowing, mutating-while-iterating crashes, and architectural flaws in a distributed rate limiter.
api/fetcher.js
Review a JavaScript module handling data fetching and state updates. Find async/await pitfalls and race conditions.
db/reports.js
Review a Node.js database service. Identify multiple sophisticated SQL injection patterns in dynamic queries.
components/UserProfile.jsx
Review a React component for XSS risks (dangerouslySetInnerHTML) and sensitive data leaks in console/URLs.
auth/middleware.py
Review Django middleware and auth backends for bypasses, timing attacks, and improper exception handling.
services/inventory.js
Identify race conditions and stale state updates in a Node.js singleton service responsible for inventory tracking.
All endpoints available at http://localhost:7860
| Method | Endpoint | Description | Copy cURL |
|---|
api/async_handler.js
Review an async JS handler with unhandled promise rejections, missing await, callback hell, memory leak from uncleaned event listeners, and swallowed errors.
api/endpoints.py
Review a FastAPI endpoints file with JWT algorithm bypass, wildcard CORS, missing rate limiting, exposed stack traces, IDOR, and debug mode enabled in production.
models/database.py
Review SQLAlchemy ORM models for N+1 queries, missing foreign key indexes, uncommitted transactions, mutable default arguments, and missing cascade rules.
auth/jwt_handler.py
Review a JWT auth system for weak secrets, missing token expiry, disabled signature verification, session fixation, missing token revocation, and timing attacks.
pipeline/processor.py
Review a batch data processing pipeline for memory leaks, missing None checks, silent int8 overflow, unclosed file handles, bare except clauses, and off-by-one slicing.