Sent every Monday at 9am. Here's a sample for a real engineering team.
Weekly recap · Jun 16–22, 2026
14
bugs caught across 11 PRs
1
Critical
4
High
6
Medium
3
Low
Top catches this week
SQL injection via unsanitized user ID parameter
getUserById interpolates req.params.id directly into the query string. An attacker can exfiltrate the full database with a single crafted request.
Missing await on async function causes silent data loss
saveOrder() is async but called without await. Order confirmations send before the DB write completes — data loss under load.
JWT secret falls back to empty string in production
process.env.JWT_SECRET || '' means any token signed with an empty key is valid on a misconfigured deploy. Should throw on missing secret at startup.
Repo leaderboard
⏱ Estimated time saved: ~2.2 hours — based on 11 PRs reviewed × 12 min average.
Free to install. Connects to GitHub in 60 seconds. No credit card.
Install PullLight free → Included on every plan, including free.