Review gallery
The panel, on real pull requests
Recent reviews the PR Quorum panel ran on public open-source PRs — every finding, verdict, and reviewer, exactly as it ran. Newest first.
- reviews
- 27
- findings surfaced
- 55
- high or critical
- 19
- repositories
- 25
wonderwhy-er/DesktopCommanderMCP #597open2h ago
Add SSRF protection to read_file URL fetches (#587, #560)
Mmed
Redirect loop may leak internal IP via DNS resolution
src/tools/filesystem.ts
minor notes3 findings
XiaomiMiMo/MiMo-Code #1728open2h ago
fix(provider): guard non-array message content in part mapping (j.map is not a function)
Hhigh
normalizeContentArray does not convert string content to array, leaving .map() crash unfixed
packages/opencode/src/provider/transform.ts
needs attention2 findings
stablyai/orca #9325open2h ago
fix(rate-limits): refetch claude usage when the last live Claude PTY exits
Mmed
Potential race condition: drain listener fires before state is updated
src/main/rate-limits/service.ts
minor notes1 finding
HKUDS/Vibe-Trading #676open2h ago
fix(session): enforce lifecycle and concurrent-run invariants
Mmed
Test helper _FakeMessage incompatible with _convert_messages_to_history
agent/tests/test_session_service_lifecycle.py
minor notes3 findings
EpicGames/lore #115open2h ago
fix: skip needless remote connects in local read paths
Mmed
Unused `remote_available` variable in status function
lore-revision/src/repository/status.rs
minor notes1 finding
microsoft/SkillOpt #148open2h ago
feat(devin): add SessionEnd hook + install script
Hhigh
jq merge overwrites existing SessionEnd hooks instead of merging arrays
plugins/devin/install.sh
needs attention3 findings
antirez/ds4 #571open2h ago
server: restore schema-declared argument types for GLM tool calls
Mmed
json_schema_value_type leaks memory on early return
ds4_server.c
minor notes2 findings
odysseus-dev/odysseus #5594open2h ago
fix(security): don't let manage_settings re-enable disabled tools
Mmed
disable_tool may silently skip already-disabled tools
src/agent_tools/admin_tools.py
minor notes1 finding
langgenius/dify #38997open2h ago
fix: prevent hidden-tab collaboration leader from saving stale drafts
Mmed
Unsafe conversion of client-provided graphActive value using bool()
api/services/workflow_collaboration_service.py
minor notes4 findings
open-webui/open-webui #27186open2h ago
feat: forward chat_id as user field in OpenAI-compatible chat completions
Hhigh
Crash when metadata is not a dict
backend/open_webui/routers/openai.py
needs attention2 findings
sgl-project/sglang #31674open2h ago
fix: preserve speculative draft weights across release/resume_memory_occupation
Mmed
_export_full_state silently skips tensors that fail to clone, potentially losing draft weights
python/sglang/srt/managers/scheduler_components/weight_updater.py
minor notes3 findings
BerriAI/litellm #33720open2h ago
fix(prometheus): serve /metrics directly without 307 redirect
Hhigh
ASGI send/receive protocol violation: nonlocal body may be overwritten by multiple send calls
litellm/integrations/prometheus.py
needs attention6 findings
ggml-org/llama.cpp #25847open3h ago
webgpu : add CONV_2D_DW (depthwise conv2d) kernel
Hhigh
Incorrect weight indexing in CWHN shader variant
ggml/src/ggml-webgpu/wgsl-shaders/conv2d_dw.wgsl
needs attention1 finding
ggml-org/llama.cpp #25544open3h ago
common : add support for multiple end sequences in the reasoning budget sampler
Hhigh
reasoning_budget_message handler depends on unreliably ordered field processing
tools/server/server-schema.cpp
needs attention2 findings
denoland/deno #36153open3h ago
feat: sqlite web cache api expiration
Hhigh
Missing database schema migration for new column 'last_inserted_at'
ext/cache/sqlite.rs
needs attention3 findings
denoland/deno #36028open3h ago
fix: handle UTF-16 diagnostic columns
Hhigh
Potential out-of-bounds read via encode_utf16 on non-BMP character boundary
cli/tsc/diagnostics.rs
needs attention2 findings
astral-sh/uv #20507open3h ago
Avoid Tokio startup for synchronous CLI commands
Llow
Duplicated workspace discovery logic in discover_install_path
crates/uv-workspace/src/workspace.rs
minor notes1 finding
zed-industries/zed #61045open3h ago
editor: Fix Shift-click selection after cursor movement
Hhigh
move_offsets_with does not reset select_mode
crates/editor/src/selections_collection.rs
needs attention2 findings
grafana/grafana #128724open3h ago
Provisioning: retry dashboard provisioning while the folder API is unavailable
Hhigh
isRetriableFolderError may miss wrapped gRPC status errors
pkg/services/provisioning/provisioning.go
needs attention2 findings
go-gitea/gitea #38518open3h ago
fix(actions): correctness and hardening fixes
Hhigh
Potential nil pointer dereference when calling fillViewRunResponseSummary from a GET handler
routers/web/repo/actions/view.go
needs attention1 finding
sqlalchemy/sqlalchemy #13435open3h ago
Add log_note execution option
Hhigh
Abstract method _get_log_note breaks custom ExecutionContext subclasses
lib/sqlalchemy/engine/interfaces.py
needs attention1 finding
fastapi/fastapi #15965open3h ago
perf: optimize jsonable_encoder by skipping redundant recursive calls…
Hhigh
Short-circuit skips exclude_none/exclude_defaults filtering for nested BaseModel fields
fastapi/encoders.py
needs attention3 findings
remix-run/react-router #15324open3h ago
Prevent streaming disconnects from crashing Node
Hhigh
destroyWritable may silently swallow legitimate writable errors
packages/react-router-node/stream.ts
needs attention1 finding
nuxt/nuxt #35644open3h ago
fix(nuxt): don't inject auto-imports into linked libraries
Mmed
isExternalId returns true for absolute paths outside layer roots even when include matches
packages/nuxt/src/imports/transform.ts
minor notes1 finding
vercel/next.js #95920open3h ago
fix: wire experimental.webVitalsAttribution into useReportWebVitals
Hhigh
process.env.__NEXT_HAS_WEB_VITALS_ATTRIBUTION is always a string, not a boolean
packages/next/src/client/web-vitals.ts
needs attention1 finding
Leantime/leantime #3653open4h ago
feat(users): weekly_hours + employment_type on user (Slice 1)
Hhigh
Server-side authorization missing for capacity field writes
app/Domain/Users/Controllers/EditUser.php
needs attention2 findings
tailscale/tailscale #20451open3d ago
cmd/tailscale/cli: fix plain TCP serve status
Mmed
Broken line break: newline inserted in the wrong place for TCP handlers
cmd/tailscale/cli/serve_v2.go
minor notes1 finding
Put the panel on your own PRs
Installs in two minutes. Free tier included — no card required.