We Let AI Review Every Pull Request for Three Months. Here's What It Actually Caught.
AI code review tools are everywhere now. After rolling one out on a real project, I learned more about our team than about the tool itself.
Lab notes
12 notes
#code quality.
Every Exception Was Caught. No Error Was Handled.
A client's codebase had try-catch blocks wrapped around everything. Nothing ever crashed. Nothing ever worked correctly either. The error handling strategy was actually an error hiding strategy.
The Feature Flag Graveyard We Built Over Two Years
How 340 feature flags turned a codebase into a minefield — and the boring process that dug us out.
I Audited a Codebase That Was Vibe-Coded in Two Weeks
A startup founder built their MVP almost entirely with AI coding agents. It worked. Then they hired a team, and within two months nobody could ship anything. I got called in to figure out why.
Setting Measurable Goals - Improving Code Quality with SonarQube
Learn how to set measurable goals for improving code quality with SonarQube, complete with setup instructions.
Stop Calling Everything Technical Debt
A client showed me their "tech debt backlog" with 214 items. Missing tests, outdated dependencies, bad naming, a database nobody understood, and an actual architectural shortcut from 2019. Lumping all of that into one bucket is why none of it gets fixed.
The Codebase That Slowly Stopped Agreeing With Itself
A client's AI-assisted codebase passed every lint check and had solid test coverage. But under the surface, modules had drifted into contradictory patterns — three retry strategies, four error-handling philosophies, and a data validation layer that depended on which AI session wrote the code.
The Permission Model That Grew Until Nobody Understood It
The app started with three roles. When I audited it, there were 94 permissions, 17 roles, and a function called checkAccess that was 400 lines of nested conditionals.
The Security Scanner We Trained Ourselves to Ignore
A client added a SAST scanner to their CI pipeline after a compliance audit. Six months later, nobody looked at the findings. Then a real SQL injection shipped to production.
The Test Suite With 90% Coverage That Caught Zero Bugs
A client's codebase had impressive test coverage numbers. Then I introduced a deliberate bug and watched every single test pass. Coverage was measuring execution, not verification.
We Deleted 30% of the Codebase and Nothing Broke
A client's team was drowning in a 200K-line TypeScript monolith. When we finally measured what was actually running in production, we found that almost a third of it was dead code nobody had touched in over a year.
What I Look for in the First Hour of a New Codebase
After parachuting into dozens of client projects, I've developed a mental checklist for the first sixty minutes. Most of what matters isn't in the code itself.