Operator Insights

Reported by others3

1. 

   Liran BrimerSenior Tech Leadmonday.com

   monday.com's R&D organization, with Qodo reviewing pull requests in CI alongside its existing linters and danger rules.

   Qodo customer story, published Nov 10, 2025Read the case study (opens Qodo customer story in a new tab)

   Observation

   monday.com made Qodo its default pull request reviewer, and Qodo's case study credits it with stopping issues before production.

   Takeaway

   Give the reviewer your rules. Before using the case-study numbers, ask how the team counted prevented issues and saved hours.

   What happened

   monday.com added Qodo to its CI pipeline after relying on static analysis, linter rules, and custom danger rules that matched patterns. Qodo used the organization's requirements to suggest code, detect issues, and describe pull requests. An early finding flagged environment variables exposed through a public API. Brimer reports that it revealed gaps in manual review. Qodo reports about 800 potential issues stopped each month and about an hour saved per pull request. The reviewer now runs by default across engineering.

   • Vendor case study (Qodo, named customer)
   • Vendor-reported metrics
   • No model named

   Deployment details

   monday.com's R&D organization, with Qodo reviewing pull requests in CI alongside its existing linters and danger rules.

   • Vendor case study (Qodo, named customer)
   • Vendor-reported metrics
   • No model named

   Team

   monday.com R&D, about 500 full-stack and DevOps developers

   Workload

   Pull requests across monday.com's platform code

   Product version

   Qodo in the CI pipeline: code suggestions, issue detection, and PR descriptions

   Measurement

   Issues prevented per month and time saved per pull request, as reported in Qodo's case study

1. Kudelski SecurityJan 15, 2026Kudelski SecurityKudelski Security turned a pull request comment into code execution on Qodo Merge Pro's GitHub app and an AWS key with administrator rights.

   

   Nils AmietSenior Security ResearcherKudelski Security

   Security research on Qodo Merge Pro. Disclosed at Black Hat USA in 2025. Write-up published January 15, 2026.

   Its own announcement, published Jan 15, 2026Read the write-up (opens the announcement in a new tab)

   Observation

   Kudelski Security turned a pull request comment into code execution on Qodo Merge Pro's GitHub app and an AWS key with administrator rights.

   Takeaway

   Treat the GitHub app as a supply chain dependency. Check its write access, how comments reach its tools, and its response to past disclosures.

   What happened

   Amiet used a pull request comment to execute code on Qodo Merge Pro's production GitHub app server and expose an AWS administrator key. It was the second such leak after Amiet's 2024 findings. An attacker could have taken over Qodo's AWS infrastructure and gained write access to customer repositories. Kudelski reports that Qodo fixed every issue by October 2025.

   • Public organization write-up (security research)
   • Vulnerability disclosure, no usage metrics
   • No model named

   Deployment details

   Security research on Qodo Merge Pro. Disclosed at Black Hat USA in 2025. Write-up published January 15, 2026.

   • Public organization write-up (security research)
   • Vulnerability disclosure, no usage metrics
   • No model named

   Team

   Kudelski Security research

   Duration

   Findings from 2024 and 2025, all fixed by October 2025

   Workload

   Qodo Merge Pro's GitHub app and the AWS infrastructure behind it

   Product version

   Qodo Merge Pro

   Measurement

   Disclosure timeline: Qodo deployed a fix for the AWS key leak within hours of confirming the April 2025 report. It fixed the code execution bug reported September 30, 2025 on October 22, 22 days later. It rotated the AWS key on October 24.

2. Victor LyuboslavskySep 21, 2026GitHub (RawTrail/RawTrail, formerly getvictor/fleet-edr)An engineer priced Qodo's credits at his repository's push rate and moved to self-hosted PR-Agent for a fraction of the cost.

   

   Victor LyuboslavskyEngineer, Fleet Device ManagementRawTrail (formerly fleet-edr), an open source macOS EDR project

   Public fleet-edr repository, now RawTrail, averaging 2.35 commits per pull request, with Qodo reviewing every push.

   GitHub (RawTrail/RawTrail, formerly getvictor/fleet-edr), published Sep 21, 2026Read the issue (opens GitHub (RawTrail/RawTrail, formerly getvictor/fleet-edr) in a new tab)

   Observation

   An engineer priced Qodo's credits at his repository's push rate and moved to self-hosted PR-Agent for a fraction of the cost.

   Takeaway

   Price the reviewer against your commit rate. Decide whether it runs on every push or once per pull request before comparing plans.

   What happened

   Qodo replaced per-seat billing with a US$30 base plan and pooled credits that expire monthly. At the repository's push rate, Lyuboslavsky estimated 350 to 530 agentic reviews a month, costing US$590 to US$895 against US$38 on the old plan. Lyuboslavsky moved open source PR-Agent into GitHub Actions and ran it once when each pull request opened. The estimated model bill was about US$27 a month on GPT-5.6-Sol. The reviewer runs on a different vendor's model than the one that writes the code, so the two do not share blind spots. On October 10, 2026, Lyuboslavsky reported PR-Agent running and Qodo being retired.

   • Public practitioner write-up (GitHub issue)
   • Volume measured, costs estimated
   • Model named

   Deployment details

   Public fleet-edr repository, now RawTrail, averaging 2.35 commits per pull request, with Qodo reviewing every push.

   • Public practitioner write-up (GitHub issue)
   • Volume measured, costs estimated
   • Model named

   Team

   Repository owner, working with Claude as the coding agent

   Duration

   30 days of pull request volume, September 2026

   Workload

   227 merged pull requests, with a median diff of about 41 KB

   Product version

   Qodo agentic review on every push, replaced by open source PR-Agent in GitHub Actions

   Model

   GPT-5.6-Sol for PR-Agent

   Measurement

   Monthly cost estimated from counts of pull requests, commits per pull request, and diff size