What happens to your code when an AI reviews your pull request?

Every AI code reviewer has to send your diff to a model somewhere. We build one, Owlet Lens (open source, Apache-2.0), so here's what we did about the three things that worried us most.

1. Secrets in the diff

Before anything leaves your CI, the diff, the files it imports and the developer replies pass through a scanner. API keys, tokens, passwords in connection strings and PEM private keys become [REDACTED]. The number of redactions is logged, so you can check it is working.

It's pattern matching, not magic, and our docs say so. A secret that doesn't look like one gets through, and files you deliberately add as context are sent as-is.

There is no Owlet Lens server in the middle. You bring your own key (Anthropic, Gemini, DeepSeek, OpenRouter, anything OpenAI-compatible), or point it at a model you host yourself.

2. A bot that nags gets muted

Illustration of the flow.

If a finding is still open on the next push, it is not posted again. And when a developer replies "this is fine, because...", that reply can become a rule: the optional learn mode collects the findings your team declined, and when the same pattern shows up again it opens a PR adding a rule to your coding standards.

Nothing merges by itself. A person reads that PR.

3. "Don't review my draft yet"

Turn on the TL gate and the bot waits. A held PR makes no LLM call and costs nothing. A team lead presses GitHub's own Re-run all jobs, and from then on the PR is reviewed on every push.

review:
  tlGate:
    enabled: true
    leads: ["12345", "67890"]   # numeric user IDs

The switch is read from the target branch, so a PR can't switch off its own gate by editing the config. (It can still edit its workflow file, so treat this as a team courtesy, not a security boundary.)

Try it

It reviews pull requests on GitHub, GitLab, Bitbucket Cloud and Azure DevOps, as a GitHub Action or from the command line:

npm i -g @openwt-vn/owlet-lens

To check it, I opened a PR with 4 bugs I planted myself. It flagged all 4. That's a friendly test written by us, so I'm not claiming more than that: we haven't benchmarked it against other tools, and two small PRs cost us about $0.006 and $0.009.

Repo and docs: https://github.com/openwt-vn/owlet-lens
npm: https://www.npmjs.com/package/@openwt-vn/owlet-lens

If it misses something obvious or invents a problem on your code, open an issue with the case. That's the feedback we want most.