ghc-code-review-with-copilot

Open the PR on github.com and request a review from Copilot in the Reviewers panel, or use the /review command in VS Code Chat with the file open. Copilot posts findings as inline comments on the diff within about a minute.

Copilot reliably catches pattern-match issues like SQL injection via string concatenation, MD5 password hashing, unsigned JWTs, unreachable code, and missing docstrings. It usually misses context-dependent issues like missing authorization checks and unbounded pagination parameters.

Plant a known set of issues in a diff, run the review, then classify each finding as true positive or false positive. Precision is true positives divided by all findings; recall is planted issues caught divided by total planted issues.

No, the false-positive rate is too high to gate merges. Use it as a first-pass filter for style, dead code, and common security patterns while humans focus on architecture fit and business logic.

AI review lacks business context, so it misses authorization flaws, caller-behavior reasoning like unbounded per_page values, and architecture concerns such as mixed concerns in one module. Humans still win on who-can-do-what reasoning and structural design feedback.