AI diff reviewer found four maintainer-accepted bugs, but only in hand-picked pull requests

·2 views

A developer tested a Gemini Flash-based tool that flags possible logic bugs in git diffs, checking every flag manually across 79 public pull requests from August to October 2026. Of nine total flags, four were accepted and fixed by maintainers, all from 14 pull requests selected by hand, while the 50 pull requests chosen by a mechanical filter produced none. The tool uses a second critique pass and requires each flag to quote an exact changed line, and it sees only the diff, not the full repository. The author notes the sample is small and that they cannot yet separate whether the tool or the selection method explains the gap. Nobody had installed the tool when the post was written.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vercel's Agent Desktop Lets AI Agents Operate Native Apps Without Hijacking the Cursor

Vercel Labs has released Agent Desktop, an open-source framework that lets AI agents control native applications on Mac, Windows, and Linux. Instead of relying on screenshot-based vision, the tool reads operating system accessibility APIs and structured UI trees to identify buttons, menus, and text fields. This allows several agents to run in the background on tasks like notes, calendar reminders, or log parsing without taking over the user's mouse. The article also cites demonstrations in which an agent corrected faulty song metadata and played the right track on Spotify. The piece presents these developments as a shift from AI that answers questions toward AI that takes action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shared Data Definitions Come First in CTV Campaign Measurement

Measurement for connected TV campaigns depends on agreed definitions of events before dashboards are built, since a technically accurate report can still answer the wrong question. The article argues that developers, media operators and sales teams should align on what each event means, where it originates and how it links to business outcomes. It separates the observed action, such as a button click, from business qualification, such as a valid lead, and recommends documenting triggers, sources, timestamps, owners and exclusions for each event. It also advises testing failure states like validation errors and page refreshes, and keeping media delivery records distinct from CRM progression, joining them only where evidence supports it. The illustrative schema is presented as a discussion aid rather than a production design, since available platform data varies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UET Taxila 2025 Cycle II Closing Merit Rose 5 to 19 Points Above 2024 Cycle I

Open-merit closing scores for UET Taxila's 2025 Cycle II ran 5 to 19 points higher than the 2024 Cycle I figures across programs, according to a comparison of the university's portal tables. The gap is partly due to comparing different years, since no 2025 Cycle I table has been published. Cycle II opened after the second entry test in late June 2025 to fill seats left vacant by Cycle I, and a smaller seat pool with a new group of test-takers pushed the closing aggregate up. The analysis notes that prospectus closing merit figures are calculated differently from portal figures, so applicants should check which source a number came from. Official closing merit data should be confirmed directly on the university's admissions website.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds invite gate bypass via database access in FastPass build log

The author of FastPass, a paid inbox product, had secured their invite-only gate on the server after earlier moving it out of the browser. Reader feedback prompted a check of the database layer, which Supabase exposes directly to the browser through PostgREST and governs with Row Level Security. Testing confirmed that RLS allowed clients to write a value the gate relied on, meaning the gate could be bypassed. To avoid touching production data, the author rebuilt the schema from read-only catalog queries into a disposable Postgres instance and verified it matched production using a policy hash. They then ran 70 probes as anonymous, logged-in, and service-role callers, each inside a rolled-back savepoint, and the first run exposed several classes of problems.

0 comments Read more at DEV Community