PixelOkay
Browser-first · No uploads
Tools
DEVELOPER TOOLS / CODE QUALITY LAB

Code Reviewer

Flag suspicious patterns, complex functions and repeated logic before they slow you down. Explainable local checks, plus optional on-device AI where supported.

✓ No accounts✓ Source stays in this tab✓ Actionable findings
01 / WORKSPACE

Bring your source

Review several files together, or start with a quick paste.

Drop source files or a ZIP here

Or choose files, select a folder, or paste into the editor below.

Source editor

Select or create a file to start

0 lines · 0 charactersEdits remain local until you download the file
Ready to inspect?

Rules flag patterns that deserve review; they do not prove a vulnerability or guarantee code is safe.

02 / REVIEW REPORT

Understand the risks

Follow each flagged location, see why it matters, and decide what to change.

Your findings will appear here

Upload code or try the demo, then select Review code. Nothing is executed or transmitted.

01

Explainable by design

Each rule offers a source location, severity, confidence, rationale, and next-step guidance. Findings are leads, not proof.

02

Private by default

Sources are read in your browser, never run, and not stored by PixelOkay. Reports omit source bodies and redact common secret patterns.

03

Honest about limits

This lightweight scanner does not build projects, resolve dependencies, follow full data flow, or replace full AST-based SAST or human review.

How AI Code Reviewer works

1. Import source: Paste files, upload multiple files, choose a directory, or open a ZIP containing source text. Binary files, very large inputs and unsafe ZIP paths are rejected.

2. Review: Click Review code. A Web Worker (when available) runs local, regex-based rules and approximate complexity/duplication checks. The tool does not execute uploaded code.

3. Triage: Select a finding to view why it was flagged. Use filters and navigate to the source line. Export JSON, Markdown, CSV or SARIF 2.1.0. Report files omit full source bodies; SARIF excludes source excerpts. Use Workspace ZIP to save your edited project.

Optional AI: Choose an available built-in LanguageModel or a compatible WebGPU model in AI Model Setup. WebLLM runtime code and model files are downloaded from pinned external hosts only after explicit consent. Code remains local for inference. An AI second opinion is advisory, not proof.

Known limitations: Heuristic rules can miss vulnerabilities or flag safe code, and line-based function/complexity metrics are only estimates. Generated files, minified code and unusual language syntax can distort results. It cannot audit dependencies, execute tests, verify fixes, or prove a codebase secure. Nothing is persisted when this tab closes. Download the Workspace ZIP before closing if you made edits.
LOCAL AI SETUP

Set up AI on this device

First, a model needs to be loaded on your device

Code Reviewer runs inference locally. WebLLM runtime files and model downloads come from external providers after you choose Download & Load. Browser-native models are managed by your browser.

  1. 1. Check device
  2. 2. Download / cache
  3. 3. Set up assistant
  4. 4. Review code

Device & model resources

Measurements may be approximate
Device RAM / model memoryChecking…

Live RAM and model working-memory use unavailable.

Checking WebGPU availability…

Browser website storageChecking…

Site-wide estimate includes all same-origin PixelOkay tools, and is not RAM.

ONE ACTION · ALL RECOGNIZED AI MODEL DOWNLOADS

Free AI model storage across PixelOkay

Scan this website origin for WebLLM and Transformers.js model caches and recognizable model files, including other PixelOkay tools. Only positively recognized Cache Storage model artifacts are eligible for cleanup here. IndexedDB, OPFS, browser-managed models, projects and user data are not cleared automatically.

Run a scan to identify safely removable model artifacts. This release does not delete unverified browser databases.

Cache status not yet verified. Refresh Storage & Cache to check the selected model.

Preparing model setup…

Having trouble downloading or loading AI?

Refresh Storage & Cache, then retry or choose a smaller model. If storage is the problem, inspect recognized model caches before any deletion. WebGPU and network errors are not generally solved by clearing caches.

Do not clear all website data: that can remove saved work across PixelOkay. Only safely identified model assets are considered here.

Technical details and diagnostics

WebLLM runtime pinned to 0.2.87 (same as AI Chat V9.3). Model cache detection requires runtime metadata. Same-origin does not guarantee identical model revisions or cross-runtime reuse. An actual cache-hit test needs a real GPU/browser.
CROSS-TOOL MODEL CACHE CLEANUP

Delete recognized model downloads?

Other PixelOkay AI tools may need to re-download model files. Close active AI tabs first. Unknown caches and IndexedDB are untouched; never clear general website data without exporting your work.

Using Code Reviewer

Inspect a local source workspace with rule-based checks and review possible issues before editing files or exporting a report. Use findings as leads that require confirmation in the source and your project context.

  1. Import supported source files, a folder or ZIP, then inspect the file list and workspace size.
  2. Run the heuristic review, filter findings by severity, open the relevant source and edit files only after checking the reported context; source changes make earlier findings stale.
  3. Review report excerpts and export Markdown, JSON, CSV, SARIF or a workspace ZIP.

Example: Import a small JavaScript folder, open a possible risky string operation from the findings list, verify whether input is actually untrusted, then export a SARIF report with excerpts omitted.

Limits and privacy: Heuristic findings are not confirmed vulnerabilities, complete parsing or a security audit. The workspace is limited to 120 files and 12 MB, with at most 1,000 retained findings. Markdown/JSON/CSV exports may include sensitive source excerpts; SARIF intentionally omits excerpts. Optional browser-native AI may be unavailable and is not required for rule-based review.

Frequently asked questions

Does a finding confirm a vulnerability?

No. Findings are rule-based leads. Check the source and runtime context to decide whether the condition is reachable and meaningful.

Which exported report can contain source excerpts?

Markdown, JSON and CSV can include excerpts. SARIF intentionally omits them, but still review report metadata and project names before sharing.

Related tools