Source-backed analysis10
Review basis
Research-based review: the AppDuo Editorial Team compiled it from official pages, documentation, app stores, press and user feedback, without hands-on testing. Every claim links to a source with the date it was checked.
10 reference sourcesInformation updated Nov 11, 2026
How we review
CodeRabbit Review
AI pull request reviews, free for public repositories
By AppDuo Editorial Team · Fact-checked
- Web
- Browser extension
On this page
Decide at a glance
Our verdict
CodeRabbit suits teams with a heavy pull request load that want an automated review pass on GitHub, GitLab, Bitbucket or Azure DevOps. The trade-offs are per-developer pricing, per-plan caps on repos and reviews, and a serious 2025 security flaw that has since been fixed.
Best for: Teams with many PRs wanting an AI review before human sign-off
Skip it if: Teams that cannot let code leave their infrastructure but will not buy Enterprise
Pros
- Works with GitHub, GitLab, Bitbucket and Azure DevOps
- Free reviews for public repositories
- VS Code extension (also in Cursor and Windsurf), JetBrains plugin (beta) and CLI
Cons
- From 24 USD/developer/month billed yearly; no free tier for private repos
- Each plan caps linked repos and reviews per hour
All pros and cons · Who is it for?
More pros
- 14-day trial; billed only for developers who open PRs
More cons
- A 2025 remote code execution flaw on its servers (patched)
- Weak user ratings: 2.1/5 on Trustpilot (10 reviews), 3.7/5 on the VS Code Marketplace (28 ratings)
Best for
- Public open-source projects (reviewed for free)
Skip it if
- Solo developers with private repos on a tight budget
Experience & key features
CodeRabbit is an AI pull request review tool. According to its homepage it reviews every PR automatically, scores and ranks PRs by risk, explains large diffs and runs security scans. The company cites 17K customers and 6M repositories; these are vendor-reported figures.
The docs say CodeRabbit installs on GitHub, GitLab, Bitbucket and Azure DevOps, with a VS Code extension that also runs in Cursor and Windsurf and a JetBrains plugin in beta. Enterprise adds self-hosting, SSO and audit logs.
List prices are per developer who opens PRs: Essentials 30 USD/month (24 USD billed yearly), Team 60 USD (48 USD), Advanced 90 USD (72 USD). Reviews beyond the allowance cost 0.25 USD per file. Public repos are free and paid plans have a 14-day trial. The pricing page does not mention refunds.
Unlike coding assistants such as GitHub Copilot or Cursor, CodeRabbit focuses on PR review rather than writing code. Two points to weigh: code is sent to AI model providers, and the 2025 flaw published by Kudelski Security (since patched).
Screenshots
Plans & pricing
Prices last verified Nov 11, 2026
Open source
PersonalFree
Free reviews for public repositories, with no time limit.
Essentials
Business$30/mo/user
$24/mo billed yearly
1 linked repo, 5 PR reviews per developer per hour, 5 MCP connections.
Team
Business$60/mo/user
$48/mo billed yearly
5 linked repos, 8 PR reviews per developer per hour, 10 MCP connections; adds unit test generation, the Triage queue and 10 custom pre-merge checks.
Advanced
Business$90/mo/user
$72/mo billed yearly
10 linked repos, 10 PR reviews per developer per hour, 15 MCP connections; adds continuous security review and security-informed PR prioritisation.
Enterprise
BusinessContact sales
Quote-based: 20 linked repos, 12 reviews per developer per hour, SSO, custom roles, audit logs, API access, self-hosting and a support SLA.
- Free plan limits
- Public repositories are reviewed for free; private repos need a paid plan.
- Free trial
- 14-day free trial · no credit card
Cancellation & refunds
The pricing page does not mention refunds. Upgrades apply immediately with prorated billing; downgrades take effect at the end of the billing cycle.
Privacy
The privacy policy says CodeRabbit, OpenAI and Anthropic do not train models on customer code, but that commitment excludes open-source projects: CodeRabbit states it uses open-source code to train its systems. Code is sent to OpenAI and/or Anthropic for reviews. Data kept to improve reviews (mainly code embeddings and Learnings) can be opted out of, and the policy says this storage is compliant with SOC 2 Type II, GDPR and HIPAA. Servers processing personal data are in the United States. Opting out of all retention requires self-hosting, which is Enterprise-only.
CodeRabbit alternatives
7.5/10GitHub Copilot
An AI coding assistant that runs in most major IDEs and ties into GitHub
7.4/10Claude Code
Anthropic's coding agent across terminal, IDE, web and CI
Controversies & incidents
Issues documented by the press, regulators, courts or the vendor itself. Every item is sourced; unproven claims are labelled as allegations. Last researched: Nov 11, 2026
- Medium impactResolvedSecurity ·
Remote code execution flaw published by Kudelski Security
Kudelski Security reported that a malicious PR could run code on CodeRabbit servers and expose its GitHub App private key. CodeRabbit says it shipped a fix within 12 hours and found no evidence of customer data access.
Read the full account
Kudelski reported the issue on 24 Jan 2025 and published its write-up on 19 Aug 2025 alongside a Black Hat USA 2025 talk. The researchers said RuboCop ran outside the sandbox, letting them read environment variables including OpenAI and Anthropic API keys and the GitHub App private key. They assessed that the key could grant write access to repositories that had installed the app, but tested only a couple of installations; the 1M repository figure comes from CodeRabbit's website. CodeRabbit called it "an oversight on our part": it disabled RuboCop within 1 hour, rotated the affected credentials within 3 hours and shipped a fix moving RuboCop into the sandbox within 12 hours, then audited its services and added deployment gates.
Vendor response
CodeRabbit says its investigation found no evidence that customer data was accessed or that any malicious activity occurred.
Sources:CodeRabbit: response to the January 2025 Kudelski disclosureKudelski Security: how we exploited CodeRabbit
Frequently asked questions
Is CodeRabbit free?
Public repositories are reviewed for free. Private repos need a paid plan from 24 USD/developer/month billed yearly, with a 14-day trial.
Does CodeRabbit train on my code?
Per its privacy policy and docs, customer code is not used for training. Open-source code is the exception: CodeRabbit says it uses it to train its systems.
Which platforms does CodeRabbit support?
GitHub, GitLab, Bitbucket and Azure DevOps, plus a VS Code extension and a JetBrains plugin (beta).
Can CodeRabbit be self-hosted?
Yes, on the Enterprise plan only, per the official docs.
Review evidence & sources10
Scores
- Ease of use
- 7.5
- Features
- 8.0
- Value for money
- 6.5
- Performance
- 6.5
- Support
- 6.0
- Privacy & security
- 6.2
Why this score
Installs straight into the major git platforms and has IDE extensions; the pages reviewed show an English-only interface.
Why this score
PR review, chat, pre-merge checks, unit test generation (Team and up), continuous security review (Advanced and up), self-hosting (Enterprise).
Why this score
24–72 USD/developer/month billed yearly, with repo and review caps and 0.25 USD per file beyond them; free for public repos.
Why this score
Effectiveness figures are vendor-reported with no independent verification; user ratings are middling to low (3.7/5 on the VS Code Marketplace, 2.1/5 on Trustpilot from few reviews).
Why this score
Docs and email; a support SLA and dedicated customer success are Enterprise-only.
Why this score
Pledges no training on customer code (open source excepted), offers a retention opt-out and the policy cites SOC 2 Type II compliance; but code goes to OpenAI/Anthropic and the 2025 flaw exposed its GitHub App key (since fixed).
What users say
- Trustpilot2.1/5 · 10
- Visual Studio Marketplace (VS Code extension)3.7/5 · 28
Sources
- Vendor-providedOfficial homepageNov 11, 2026
- Vendor-providedOfficial pricing pageNov 11, 2026
- Vendor-providedOfficial docs: FAQ and data handlingNov 11, 2026
- Vendor-providedOfficial privacy policyNov 11, 2026
- Vendor-providedCodeRabbit: response to the January 2025 Kudelski disclosureNov 11, 2026
- pressKudelski Security: how we exploited CodeRabbitNov 11, 2026
- Vendor-providedCodeRabbit newsroom: Series BNov 11, 2026
- Vendor-providedCodeRabbit newsroom: Series CNov 11, 2026
- review-siteTrustpilot: CodeRabbitNov 11, 2026
- storeVisual Studio Marketplace: CodeRabbit extensionNov 11, 2026
Specs & compatibility
- Developer
- CodeRabbit Inc.
- Headquarters
- United States
- Launched
- 2023
- Category
- Development
Capabilities
- AI features
- Integrations
- Real-time collaboration
- Self-hostable
- Public API
Platforms
- Web
- Browser extension
Interface languages
- English
Integrations
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Jira
- Linear
- Slack
- VS Code
- JetBrains
Support
- Help center
Change history
- Company.Announced a 143M USD Series C at a 1.5B USD valuation, co-led by Atomico and Smash Capital.
- Company.Announced a 60M USD Series B at a 550M USD valuation led by Scale Venture Partners.
- Update.Kudelski Security reported a vulnerability through CodeRabbit's disclosure program; the fix was confirmed on 30 Jan 2025.
About the author
Reviews & comments
Written by readers with a verified email address.
No reviews yet. Have you used CodeRabbit? Share your real experience.
Reader reviews are counted separately and do not affect the Editorial Team’s score.
No comments yet. Be the first to share your experience.
Comments are readers’ opinions, not content from the AppDuo Editorial Team.