Hi HN, I'm building Whisper (https://usewhisper.dev), an AI code reviewer that does both code quality and security analysis. It traces execution flow to catch SQL injections, auth bypasses, and race conditions that standard PR reviewers miss.

The Problem

AI code reviewers catch style issues. Security scanners only check dependencies. But logical security flaws in YOUR code slip through. The SQL injection that happens because user input flows through three functions before hitting your database. The race condition in payment processing. The auth bypass hidden in middleware.

I've shipped these bugs. Your PR reviewer said "looks good." Your security scanner was green (only checks deps anyway). Two weeks later, a pentester finds the vulnerability that was visible in the PR all along.

Why Compete Against Well-Funded Startups?

Fair question. Greptile raised millions. Codacy, SonarQube, Snyk are giants. Here's my thesis: they're solving the wrong problem.

Most AI reviewers are linters with GPT. They look at the diff and comment on style. Security scanners either only check dependencies or dump 1000+ false positives. The ones that do both? Separate products that don't talk.

I'm building something different: execution flow tracing with semantic understanding. Whisper traces data from user input through your logic to find where it reaches sensitive operations.

The big players can't easily copy this. They're built on pattern matching. Tracing execution flow requires different architecture. And I have advantages:

- Speed: I ship features in days vs their enterprise compliance process - Focus: One problem (security in PRs) vs everything to everyone - Pricing: $30/dev vs their $100-300/seat enterprise model - DX: 2-minute setup vs 45-minute enterprise onboarding

They optimize for enterprise contracts. I optimize for devs who want PRs to stop shipping bugs.

How It Works

Example: Standard reviewers say "looks good"

const user = await getUser(req.headers.auth); const data = await db.query( `DELETE FROM users WHERE id = ${user.id}` );

Whisper traces user.id from JWT payload through getUser() to the SQL template literal. Flags SQL injection. Suggests parameterized queries.

Race condition example:

async function processPayment(userId, amount) { const balance = await getBalance(userId); if (balance >= amount) { await charge(userId, amount); await updateBalance(userId, balance - amount); } }

Whisper spots concurrent requests could cause double-charging between check and update.

Status

Private beta with early engineering teams. 2.4M+ lines analyzed, 1,247 bugs caught, 47s avg scan time. Supports all major languages with deep framework understanding for Next.js, React, and tRPC.

What I Want

Feedback from engineers who: - Are drowning in false positives from scanners - Keep shipping bugs visible in PRs - Think competing here is crazy (tell me why!)

Building mostly solo, no VC. Just solving a problem I kept hitting.

Try free: https://usewhisper.dev

Nearly 5M Accounts Removed Under Australia's New Social Media Ban

U.S. News & World Report v. OpenAI, Inc. (1:25-cv-09912)

Automating Screenshots with Claude Code

Show HN: Whisper – AI code reviewer that catches security issues and bugs

The Human in the Loop

Ella Minnow Pea: A Progressive Lipo-Grammatic Epistolary Fable

The Enshittification of Enshittification

Show HN: DownloadStuffs – Fast UI for Browsing and Downloading Internet Archive

The quick brown fox jumps over the lazy dog

Ultrathink is deprecated & How to enable 2x thinking tokens in Claude Code

Vibe Working with Code Agent

Sam Altman's blind spot on AI model power

AI systems that don't just make decisions, but remember and use the "why"

I want my MTV Rewind

Practical scripts for automating doc-generation regardless of tools

The Coming Industrialisation of Exploit Generation with LLMs

Show HN: Meepr – A Quiet Social Network

EU plans to retaliate on Greenland tariffs

App Subscription is now my Weekend Project

Top Editor at Axel Springer Is Ousted After Workplace Investigation

Simple GIS on Potato

Let's send email on port 36245

Exploring hard-constrained PINNs for real-time industrial control

Salesforce Still Can't Avoid Tertiary Liability Fosta Claims–GG vs. Salesforce

The enduring pleasures of Northern Exposure

A new approach to energy harvesting opened up by the quantum world

Twitter lists are not working

Scaling developer content production at Snyk

Why America's bond market just keeps winning

RFC 1178: Choosing a Name for Your Computer (1990)

Show HN: HakHok