Sourcery

You open a pull request, grab a coffee, and by the time you're back there's a summary of what changed, a handful of inline comments, and a suggested fix you can commit with one click. That's the workflow Sourcery is built around. It reviews every PR within minutes on GitHub or GitLab, and the examples it advertises aren't style nitpicks. In one, it flags that a missing timeout on session.get means a stalled package index hangs poetry install forever. In another, from django CMS, it catches quote() re-encoding an already-encoded path so /foo%20bar/ becomes /foo%2520bar/ and breaks valid redirects. Those are the kinds of bugs that slip past a tired human reviewer at 6pm.

The pitch is "Banish your PR backlog," and the features line up with it. PR summaries tell you where to focus, which matters more now that a chunk of your diffs may come from a coding agent rather than a teammate. Low-risk PRs with no blocking findings get auto-approved so they can merge once CI passes. On the Team plan, nightly scans across 50 repos look for exposed secrets, vulnerable code, misconfigured infrastructure and dependencies with known CVEs. Sourcery says it keeps no copy of your code after a review, never trains on it, and is SOC 2 Type II compliant, which will matter if your security team signs off on tooling.

The pricing is straightforward. Public repos are free forever, with most review features included. Pro is $12 per developer per month billed annually ($15 monthly) for private repos, and Team is $24 ($30 monthly) once you want codebase-wide security scanning. Every org gets a 14-day trial of Team with no card. The catches: GitHub Enterprise Server and self-hosting sit behind custom Enterprise pricing, "higher review limits" are never quantified, and the site mentions nothing beyond GitHub and GitLab. If your team lives in one of those two and drowns in review requests, it's worth the two-minute install.