What AI code reviewers miss, and the checks I built for it

Описание и применение

Healthkit – инструмент для проверки кода Python, который измеряет эффективность правил, фокусируется на паттернах и дополняется тестированием поведения через Schemathesis, повышая надёжность обзора кода, генерируемого ИИ.

Задача

AI-generated code often contains subtle bugs that automated reviewers miss, leading to regressions and security issues.

Результат

Healthkit reduced false positives, caught real bugs, and clarified that a clean run means "nothing it knows about" rather than safety.

Рабочий процесс

• 1. Measure rule effectiveness on a human-reviewed module (45 findings, 9 true positives).
• 2. Design rules around patterns, project knowledge, and behavior.
• 3. Build healthkit with deterministic rules, AI advisory only.
• 4. Run healthkit review on changed lines with "healthkit review --base main".
• 5. Flag any rule or # noqa changes for human approval.
• 6. Use healthkit api to test API routes for crashes and access leaks.
• 7. Iterate rules based on measured precision and coverage.

Доказательства

A careful human review of one module had produced 45 findings.

Источник

The first score was 29 of 45. It looked great. Then we read every hit by hand. Most were coincidences: an unused import that happened to sit inside a behaviour fix, findings inside routes the fix deleted anyway. Counting only the hits where the rule pointed at the actual problem: 9 of 45, about 20%.

Источник

healthkit can never judge whether the logic is right, whether it is secure, or whether the design is right. A clean run means "nothing it knows about", never "safe".

Источник

healthkit api sends good and bad input to every route of an API (via Schemathesis) and treats any server error as a finding. On the test project it found six real crashes, none of which had a rule.

Источник