AI CODE REVIEW

CodeHawk

AI Code Review Platform

Review human-written and AI-generated code for quality, security, and logic issues. Understand project context, verify whether each PR fulfills its requirements, and deliver traceable evidence with actionable fixes.

Request a Demo

REVIEW INTELLIGENCEExample · Not a live scan

⑂PR / MRC++

CODE CHANGE

FTP URL field handling changes

ftp_source.cppCode excerpt

94if (!auth.empty()) {

out->user = UrlDecode(
  auth.substr(0, colon));

out->pass = UrlDecode(
  auth.substr(colon + 1));

107out->path = UrlDecode(path);

226command = "RETR " + path;

94if (!auth.empty()) {

out->user = UrlDecode(
  auth.substr(0, colon));

out->pass = UrlDecode(
  auth.substr(colon + 1));

107out->path = UrlDecode(path);

226command = "RETR " + path;

Review scopeAI + SAST

Connect code and context

Input handling

URL decoding and field assignment

Command construction

Sources of FTP command arguments

EVIDENCE PATHSelected evidence path

INPUTFTP URL

External input

↓

DECODEUrlDecode

%0D%0A → CR/LF

↓

FIELDSuser / pass / path

No CR/LF check after decoding

↓

COMMANDUSER / PASS / RETR

Fields enter FTP commands

SAST · Data-flow context

REVIEW FINDINGCWE-93 · HIGH

AI · Risk explanation and guidance

FTP Command Injection

Why it matters

Unchecked CR/LF from decoding can end an FTP command and inject another.

Affected fields

user · L96pass · L97path · L107

FIX SUGGESTIONC++

Suggested change · Not applied

Reject decoded CR/LF

Decode→+Validate→Command

auto hasCrlf = [](const auto& s) {

return s.find('\r') != s.npos ||

s.find('\n') != s.npos;

};

if (hasCrlf(out->user) ||

hasCrlf(out->pass) ||

hasCrlf(out->path)) {

return false;

}

Insert validation after decoding, before FTP commands.

Start with a change to FTP URL field handling

Illustrative review, not a live scan. First, inspect an FTP URL handling change. Then trace input, UrlDecode, user/pass/path fields and FTP control commands. This is a selected evidence path, not a complete call graph. Explain the command-injection risk caused by unchecked CR/LF. Finally, suggest rejecting carriage returns and line feeds after decoding and before constructing FTP commands. The suggestion is not applied and requires developer review and testing.

Quality, security, and logic review: AI Code Review
Verify PR implementation against requirements: Requirement Alignment
Context enriched by SAST call graph and data flow: SAST-based Context
Configurable enterprise review capabilities and policies: Custom Skills

PRODUCT OVERVIEW

From Finding Issues to Verifying Implementation

CodeHawk goes beyond reviewing AI-generated code. It understands every code change and its impact, identifies quality, security, and logic risks, verifies that requirements are implemented, and helps developers remediate issues faster.

01 / REVIEW

Automated Code Review

Automatically review code in IDE, PR/MR, and CI/CD workflows for defects, security, quality, coding standards, and logic issues.

02 / CONTEXT

Deep Context Understanding

Correlate call graphs, function definitions, data flows, files, and project background knowledge to reduce diff-only false positives and missed issues.

03 / ALIGNMENT

Requirement Alignment

Break requirements and acceptance criteria into verifiable checks, map them to code, configuration, and tests, and identify implementation gaps or scope drift.

04 / ACTION

Explain and Remediate

Deliver evidence, severity, impact, remediation guidance, and reference code, with conversational follow-up for deeper investigation.

CORE CAPABILITIES

Core Capabilities

04 GROUPS / 16 CAPABILITIES

Combine code review, context understanding, requirement alignment, remediation guidance, and enterprise policies in a configurable, traceable engineering workflow.

01 / AI REVIEW & CONTEXT

Understand every change and its upstream and downstream impact

Quality, Security & Logic Defects

Detect null-pointer issues, resource leaks, injection, concurrency defects, exception-handling gaps, boundary conditions, and business-logic errors.

Cross-Function Context Analysis

Adaptively connect relevant callers, callees, definitions, references, and critical data paths based on risk.

Project-Level Code Understanding

Use directory structure, module relationships, framework conventions, configuration, and dependencies instead of reviewing snippets in isolation.

Finding Normalization & Deduplication

Unify AI and static-analysis results, merge duplicates, and prioritize findings by severity, confidence, and impact.

02 / SUMMARY & REMEDIATION

Make every review result clear and actionable

PR & File Change Summaries

Summarize the purpose, key files, behavioral changes, impact scope, and risk areas that require attention.

Evidence-Grounded Explanations

Connect affected code, call paths, data flows, and triggering conditions to explain why an issue is valid and what it can cause.

Remediation Guidance & Code

Provide project-aware remediation strategies and reference code for developers to review, validate, and adopt.

Conversational Follow-Up

Ask follow-up questions about causes, impact, alternatives, and validation methods to accelerate resolution.

03 / REQUIREMENT ALIGNMENT

Verify that what was built matches what was required

Requirement & Acceptance Decomposition

Turn requirement documents, user stories, and acceptance criteria into explicit, verifiable implementation checks.

Requirement–Code–Test Mapping

Map every check to code changes, configurations, APIs, data structures, and test cases.

Implementation Gap Detection

Identify missing, partial, or incorrect implementations, overlooked boundaries, and unauthorized scope additions.

Traceable Alignment Reports

Report conclusions, evidence locations, confidence, and open questions for every requirement, with human review support.

04 / ENTERPRISE POLICY

Turn organizational knowledge into continuously applied review capabilities

Custom Review Skills

Define review objectives, context-retrieval methods, and output requirements for industries, projects, and business scenarios.

Enterprise & Industry Standards

Embed security standards, coding rules, architecture constraints, and internal API requirements into daily reviews.

Severity & Handling Policies

Configure severity, ignore conditions, allowlists, merge gates, and project-specific handling strategies.

Continuous Knowledge Accumulation

Turn effective fixes, false-positive decisions, and project experience into reusable rules, knowledge, and caches.

REQUIREMENT × PR ALIGNMENT

Requirement-to-PR Implementation Alignment

Go beyond “Is the code correct?” to verify “Does the code correctly implement the requirement?”

CodeHawk turns requirements and acceptance criteria into verifiable checks, then connects them to code, configuration, and test evidence in the PR. It reports not only defects, but also missing requirements, behavioral inconsistencies, omitted edge cases, and out-of-scope implementation.

01 / INPUT
Requirements & Acceptance Criteria
Requirement documents, user stories, API definitions, design specifications, defect tickets, and additional constraints
02 / ALIGN
Implementation Evidence Mapping
Diffs, call relationships, configuration changes, tests, commit messages, and project context
03 / OUTPUT
Alignment & Gaps
Implemented, partially implemented, missing, inconsistent, out of scope, or requiring human confirmation

Requirement-to-Implementation MappingReview example · Argument passing

Requirement checks, conclusions, implementation evidence, and confidence
Requirement Check	Conclusion	Implementation Evidence	Confidence
Use the atom channel for short payloads	Implemented	gui/main.cpp · L1014–1015	High
Preserve every path argument through the full round trip	Non-compliant	Embedded L'\0' truncates data after the first segment	High
Use the temporary-file channel for long payloads	Implemented	gui/main.cpp · L1018–1024	High
Keep short- and long-channel behavior consistent	Partial	Atom and file channels use inconsistent semantics	Medium

Missing ImplementationIncorrect ImplementationPartial ImplementationEdge-Case GapsOut-of-Scope ChangesInsufficient Evidence

DIFFERENTIATED ADVANTAGE

Compiler-Grade SAST Gives AI More Accurate Code Facts

Compiler-grade SAST improves CodeHawk’s accuracy on complex code by supplying AI with symbols, types, call relationships, data flows, and the actual build configuration.

01
Accurate Macro & Conditional Compilation Analysis
Analyze the code that is actually compiled under the correct build configuration.
02
Built for Complex C/C++ Projects
Support headers, vendor keywords, compiler extensions, and proprietary DSLs.
03
Ground AI in Deterministic Facts
Use call graphs, data flows, and defect evidence to reduce contextual guesswork and false positives.

COMPILER CONTEXTAI + SAST

Symbols & TypesSymbols, types, definitions, and references

Call GraphFunction call relationships and impact scope

Data FlowInputs, propagation paths, and dangerous operations

Build ContextMacros, headers, and conditional compilation

CONTEXT-AWARE REVIEWMore relevant context. More reliable AI review findings.

Illustration of AI and SAST analysis

USE CASES

Code Review Throughout the Development Workflow

IDE → PR / MR → CI / CD

Give developers consistent review capabilities in the tools and processes they already use.

01 / IDE

Review While Coding

Review the current file or selected code in the IDE to catch issues early and receive remediation guidance.

02 / PR / MR

Automated Pre-Merge Review

Analyze every PR/MR automatically and deliver change summaries, inline findings, and requirement-alignment conclusions.

03 / CI / CD

Quality & Security Gates

Run checks during build, test, and release workflows, with handling decisions based on severity and policy.

Make Every Code Change Review-Ready.

See how CodeHawk detects code issues, verifies requirement implementation, and brings AI and SAST capability into your existing development workflow.