Now in public beta — free for open source

Ship Code
With Complete Confidence

Forge reviews every pull request instantly — catching bugs, vulnerabilities, and quality issues before they reach production. Your team ships faster. Your users never notice.

Start reviewing free See it in action

PR #847 — feat/oauth-login — 3 files changed 3 issues found

auth/oauth.ts

+18 -4

                
                  const { code, state } = req.query;
              
                  if (!code) return res.redirect('/login?error=no_code');
              
                  const token = await exchangeCode(code);
              
                  const token = await exchangeCode(code, CLIENT_SECRET);
              
                  localStorage.setItem('access_token', token.value);
              
                  return res.redirect('/dashboard');

Forge AI • line 45 Critical

Storing OAuth tokens in localStorage exposes them to XSS attacks. Use httpOnly cookies instead — they're inaccessible to JavaScript.

Suggested fix

res.cookie('access_token', token.value, { httpOnly: true, secure: true });

Everything you need

Review That Never Misses

From security vulnerabilities to performance bottlenecks — Forge catches what human reviewers miss, every time.

Security Scanning

Detects OWASP Top 10 vulnerabilities, SQL injection vectors, XSS risks, and insecure credential handling before they ship.

Bug Detection

Identifies null pointer exceptions, race conditions, off-by-one errors, and logic flaws with context-aware static analysis.

Performance Insights

Flags N+1 queries, inefficient loops, memory leaks, and suggests algorithmic improvements with complexity analysis.

Code Quality

Enforces coding standards, checks test coverage, spots duplicated logic, and suggests cleaner patterns — automatically.

Team Learning

Forge explains every finding with context and educational notes — turning every code review into a coaching moment.

GitHub & GitLab Native

Inline PR comments, check runs, and blocking rules — embedded directly in your existing workflow. No context switching.

Real-time analysis

Every Issue, Ranked by Impact

Forge triage findings by severity so your team focuses on what ships safe — not noise.

Issues Suggestions Style PR #847 • 6 findings

OAuth token stored in localStorage (XSS-accessible)

auth/oauth.ts:45 • CWE-312 Cleartext Storage of Sensitive Information

Critical

SQL query built from unsanitized user input

api/user.ts:112 • CWE-89 SQL Injection

Critical

Race condition in concurrent token refresh

middleware/auth.ts:88 • potential stale token usage

Warning

N+1 query in user profile fetch loop

api/user.ts:67 • consider batching with Promise.all

Warning

Error message leaks internal stack trace to client

api/user.ts:203 • sanitize error responses in production

Info

✓

CSRF protection verified on all state-mutating routes

middleware/auth.ts • token validation correct

Passed

Setup in minutes

Zero Config. Instant Reviews.

Connect your repository and Forge starts reviewing within seconds — no rules to write, no agents to configure.

01 — Connect

Install the GitHub App

Authorize Forge on your repos in under 30 seconds. No SSH keys, no webhooks to configure — it just works.

              bash
              copy
            
              # Or install via CLI

              npx forge-cli init

              ✓ Connected to acme-org/api

02 — Review

Open a Pull Request

Forge automatically reviews every PR within 23 seconds. Inline comments appear directly in GitHub — no dashboard to check.

              diff
            
              - const q = `SELECT * WHERE id=${id}`

              + const q = db.query('SELECT * WHERE id=?', [id])

              // Forge: SQL injection prevented ✓

03 — Ship

Merge With Confidence

Block merges on critical findings, require fixes before approval, or set severity thresholds that match your team's risk tolerance.

              forge.config.ts
            
              export default {

                blockOn: 'critical',

                notify: '#eng-alerts',

              }

What teams say

Loved by the Teams Who Ship

★★★★★

"Forge caught a SQL injection in our user search endpoint two hours before it would have shipped to 40,000 users. That's not just good tooling — that's priceless."

Jordan Kim

Staff Engineer, Loom

★★★★★

"We replaced our entire manual security review checklist with Forge. Our PRs merge 3x faster and we've had zero security incidents since adopting it."

Sarah Reyes

Engineering Lead, Railway

★★★★★

"The educational comments are a game changer. Junior engineers are leveling up faster because every Forge finding explains the 'why', not just the 'what'."

Marcus Powell

CTO, Beacon Labs

Ship CodeWith Complete Confidence

Review That Never Misses

Security Scanning

Bug Detection

Performance Insights

Code Quality

Team Learning

GitHub & GitLab Native

Every Issue, Ranked by Impact

Zero Config. Instant Reviews.

Install the GitHub App

Open a Pull Request

Merge With Confidence

Loved by the Teams Who Ship

Start Reviewing in 30 Seconds

Ship Code
With Complete Confidence