Cookies, session recording and ad conversion measurement improve the product. Before you accept we measure page views and anonymous interactions, with no cookies, no recording and no profile. Reject keeps it that way. Cookie policy

Vetoo
ManifestoLive reviewAgent panelMemory & trustPricing
Resources
Competitor comparisonLearn centerDocs
Sign up
Sign inSign up
vsBenchmark
Vetoo vs CodeRabbit, Greptile and Cursor Bugbot

Vetoo found eleven defects the other AI reviewers had already missed.

30 merged pull requests, each already reviewed by one of the three, replayed for Vetoo at the exact commit that reviewer saw. Same code, same moment, a second opinion.

Read the eleven

Overview

Vetoo reported 11 confirmed defects that the reviewer already on the pull request had not: 1 critical, 8 high, 2 medium. 8 were fixed by the authors afterwards, 3 are still confirmed in the code.

Every finding, ours and theirs, was checked against what the authors did next.

30 pull requests26 repositories10 languages10 per reviewer

Confirmed defects Vetoo reported and competitors missed

3CodeRabbit
6Greptile
2Cursor Bugbot
On the 10 pull requests each reviewer had already reviewed

How Vetoo reviews

Three habits, each visible in what it caught here.

  • It reviews the fix, not only the bug.

    Four were defects the fix itself left behind: a race closed on one path and still open on the sibling path, a window a rewrite reopened and the second path that kept it open, a buffered response the new shutdown never cancelled.

  • It follows data across files, inputs and time.

    A soft delete that could not win its own merge because a sibling column was never touched, duplicate ids that pass validation and fail on the key after the parent row is committed, an error matcher waiting for a message the backend never sends, a redirect allowlist that never looked at the userinfo part of the URL, a guard that checked one condition where its siblings check two.

  • It treats the build as part of the review.

    A type declared twice so the check failed on the very commit under review, and a template that pastes spec text into generated code without escaping it.

The eleven, by the habit that caught them

4The fix
5Data flow
2Build
Defects per habit

Side by side

Vetoo vs CodeRabbit

CodeRabbit posted four comments for every one of Vetoo's on these PRs. The three defects only Vetoo reported were the quiet kind: a shutdown that leaked buffered responses, a re-entrancy window a rewrite reopened, and the second path that kept it open.

CodeRabbit 69 inline comments, Vetoo 17
Vetoo vs Greptile

Six defects only Vetoo reported, three of them rated high: a sign-in redirect that trusted userinfo, a partial write on create, spec text pasted unescaped into generated code. On the same PRs, maintainers pushed back on six of Greptile's findings.

Greptile 34 inline comments, Vetoo 20
Vetoo vs Cursor Bugbot

The strongest of the three on this set, and still two confirmed defects it did not have: a dead error-matching branch, and a soft delete that could not win its own merge.

Cursor Bugbot 35 inline comments, Vetoo 14

Test dataset

  • TypeScript8 PRs
  • Rust5 PRs
  • Go3 PRs
  • Java3 PRs
  • PHP3 PRs
  • Python3 PRs
  • Kotlin2 PRs
  • C1 PR
  • C++1 PR
  • C#1 PR

By the primary language of each diff. Public repositories, merged pull requests, September 2026.

Methodology

Same PRs, same commits. 30 merged pull requests from 26 public repositories, 10 already reviewed by each of CodeRabbit, Greptile and Cursor Bugbot, 10 languages. Each replayed on a private mirror at the exact commit that reviewer saw, original title and description, nothing else.

Adjudicated against the code. Every finding, Vetoo's and theirs, checked against what happened next upstream: fixed by the author, agreed by a maintainer, verified in the code, rebutted, or raised on code the reviewer never saw. Only confirmed defects count. The other reviewers also found defects Vetoo did not; this page shows what Vetoo added.

One rule for the ledger. A row lands only when the defect was confirmed and the reviewer already on that PR had not reported it. Repositories and pull requests are not named on this page; the adjudication sheet with them is shared on request.

The eleven

From Vetoo’s review comments, one defect per row.

Codebase and defectSeverityOutcomeReviewer on the PR
01Server framework, HTTP pipelineserver pipeline writerKotlinClosing the writer channel left up to three already-buffered responses uncancelled. A handler that won the timeout race kept its resources and could suspend forever.criticalFixed by the author before mergeNot reported by CodeRabbit
02In-memory data store, kernel-bypass networkingclient networkingCThe postpone flag was cleared before the deferred connection-state update ran, reopening the re-entrancy window the PR set out to close.highFixed by the author before mergeNot reported by CodeRabbit
03In-memory data store, I/O threadsI/O thread drainCThe follow-up connection-state update for deferred clients ran without re-arming the postpone mask, leaving the same window open on the second path.highFixed by the author before mergeNot reported by CodeRabbit
04API client, sign-in redirectredirect target parserTypeScriptNo userinfo check on the redirect target: a URL of the form attacker@allowed-host parsed to the allowed hostname and passed the allowlist.highFixed by the author before mergeNot reported by Greptile
05API client, organization gatingsign-in page guardTypeScriptThe redirect block checked one condition where every sibling org-subdomain branch checks two; the missing non-default-instance check left the guard leaning on an implicit one.mediumFixed by the author before mergeNot reported by Greptile
06Typesetting library, buildsymbol table moduleTypeScriptA type was both imported and declared locally in the same module, so the type check failed on the reviewed commit.highFixed by the author before mergeNot reported by Greptile
07Community analytics, ClickHouse datasourcedatasource definitionSQLTwo soft deletes set deleted_at without bumping updated_at on a replacing merge table versioned by updated_at, so the tombstone tied with the live row and the winner was not deterministic.highFixed by the author before mergeNot reported by Cursor Bugbot
08Developer platform, auth UIauth error mapperTypeScriptThe banned-account matcher looked for a phrase the backend never sends, so its branch could not fire.mediumFixed upstream after mergeNot reported by Cursor Bugbot
09Project management server, create flowproject serviceTypeScriptDuplicate goal ids passed the ownership check and then violated the composite primary key after the parent row was already written: a partial write on create.highConfirmed in the code, open at mergeNot reported by Greptile
10Cache emulator, cluster modecache group serviceJavaThe cluster-mode path still started every node proxy before persisting the group, so the race the PR fixed for single-node groups survived there.highConfirmed in the code, open at mergeNot reported by Greptile
11OpenAPI code generator, router templatespec validator and router templateGooperationId was emitted verbatim as a double-quoted map key in the router registration template. A quote or newline in the spec breaks the generated code.highConfirmed in the code, open at mergeNot reported by Greptile

11 defects: 3 on pull requests CodeRabbit had reviewed, 6 on pull requests Greptile had reviewed, 2 on pull requests Cursor Bugbot had reviewed. Reviews ran September 2026; these tools change weekly, and so does Vetoo. Severity: critical when normal use crashes, hangs or loses data; high when reachable input misbehaves or a stated defence is missing; medium when the trigger is narrow or the effect is latent. Where the review labelled the finding, that label stands.

Try Vetoo on your repositoryFeature comparison
Vetoo

Product

ManifestoLive reviewAgent panelMemory & trustPricingFAQ

Resources

All resourcesBenchmarkWhat is AI code review?Code review checklistVetoo vs CodeRabbitVetoo vs GreptileVetoo vs Bugbot

Developers

Docs

Company

AboutContact

Legal

PrivacyTermsSub-processorsCookie PolicyLegal notice
AI code reviewTry it out