IDLE_SCAN // LATTICE_READY
vgpu · Booting

AI CODE REVIEW BENCHMARK & TRAINING ARENA

Audit Agent Diffs Before They Ship to Production.

Coding agents write plausible pull requests that hide race conditions, injection sinks, and tool-execution escapes. Train your review reflex on real multi-language diffs and measure your precision, recall, and F1 score against ground-truth defect rules.

Enter Challenge Arena
LIVE_EVALUATION_TELEMETRYF1: 0%
Precision
0%
Recall
0%
False Flags
0
services/billing/capture-intent.tsAgent PR #412 · claude-code
Click any diff line to flag a defect

Refactored payment capture handler to check idempotency cache before charging customer card.

Isolated 0 of 1 ground-truth defect(s) in this diff.
Open Full Arena Challenge
DEFECT_TAXONOMY // BENCHMARK_SPECIFICATION

Engineered for Post-AI Code Review.

Syntax linters catch missing semicolons. Diffly trains engineers on the structural failure modes that pass CI and break production.

01 // AGENT_ANTIPATTERNSPython · TypeScript · Go

Autonomous Tool & Sandbox Escapes

Agents frequently bypass AST validators with raw eval(), shell interpolation, or unverified tool-call arguments. Diffly tests whether you catch execution sinks disguised as helper refactors.

  • Unsanitized Python eval() gadget chains in math tools
  • Indirect prompt injection in RAG document pipelines
  • Unbounded recursion in autonomous retry loops
02 // CONCURRENCY_HAZARDSReact 19 · FastAPI · Redis

Async State & Lock Race Windows

LLM-generated async handlers routinely split atomic operations into separate check-then-act reads and writes. Spot stale closure captures, missing cancellation tokens, and swallowed gather exceptions.

  • TOCTOU Redis lock checks in payment webhook handlers
  • React async effect race conditions overwriting fresh state
  • Silent task failures in asyncio.gather pipelines
03 // SECURITY_BOUNDARIESSQLModel · JWT · Next.js

Injection Sinks & Auth Drift

Even when parameterized queries protect WHERE clauses, agents interpolate sort columns, tenant headers, or redirect URLs directly. Audit subtle trust-boundary violations line by line.

  • f-string SQL injection inside dynamic ORDER BY clauses
  • SSRF via unvalidated upstream webhook redirect targets
  • Missing tenant isolation predicates on bulk mutations
EVALUATION_LOOP

Deterministic Scoring Protocol

Every submission computes exact line-level precision and recall so guessing every line tanks your score.

STEP_01
Inspect Realistic Agent PR

Read the threat model, environment specs, and unified or split diff exactly as it lands in code review.

STEP_02
Flag Exact Defect Lines

Attach line-scoped review annotations explaining the root cause and failure mode without noisy false alarms.

STEP_03
Score Precision, Recall & F1

Diffly evaluates your annotations against deterministic line-range and keyword rules or live Gemini BYOK grading.