ReviewBot — Async AI Code Review for Remote Dev Teams

Core User Journey

1. User visits reviewbot.dev and clicks 'Sign in with GitHub' → 2. OAuth completes and Supabase user + org record is created → 3. User installs the GitHub App on one or more repos from the dashboard → 4. User or teammate opens a PR on a connected repo → 5. GitHub sends a webhook to ReviewBot's edge handler → 6. Inngest job fetches the diff, calls Claude API, and posts a structured comment on the PR → 7. Slack message with summary fires to the configured channel → 8. User returns to the ReviewBot dashboard and sees the PR review in their history → 9. User invites teammates via email → 10. User hits the free-tier review limit and clicks 'Upgrade to Pro' to complete Stripe Checkout.

Architecture Pattern

GitHub webhook POST hits the Next.js edge handler which verifies the HMAC signature and enqueues an Inngest background job; the job fetches the PR diff via Octokit, sends it to the Claude API with team rules injected into the system prompt, parses the structured JSON response, posts the formatted comment back to GitHub via Octokit, fires a Slack webhook with the summary, and writes the review record to Supabase — all within a single Inngest function with automatic retries.

Data Model

User has fields: id, github_id, email, avatar_url, created_at. Organization has fields: id, github_org_id, name, plan (free|pro|team), stripe_customer_id, stripe_subscription_id, seat_limit, created_at. Repo has fields: id, org_id (FK), github_repo_id, full_name, installation_id, slack_webhook_url, rules_json, is_active. PRReview has fields: id, repo_id (FK), pr_number, pr_title, author_login, diff_sha, blockers (jsonb), warnings (jsonb), style_notes (jsonb), summary_text, github_comment_id, slack_notified_at, created_at. Subscription has fields: id, org_id (FK), status, current_period_end. Relationships: User belongs to many Organizations via OrgMember join table; Organization has many Repos; Repo has many PRReviews.

Integration Points

GitHub App (webhooks, PR comment posting, diff fetching via Octokit), GitLab OAuth (V2, MR webhooks via node-gitlab), Slack Incoming Webhooks (review summary delivery), Anthropic Claude API (PR diff analysis and structured review generation), Stripe (subscription checkout, billing webhooks, customer portal), Supabase (Postgres database, Auth, RLS), Inngest (background job queue and retry orchestration), Resend (transactional email for invites and billing alerts), Sentry (error and performance monitoring)

V1 Scope Boundaries

V1 includes: GitHub App webhook handling, Claude-powered PR review comment posting, Slack notification on review complete, team dashboard with review history, Supabase Auth with GitHub OAuth, Stripe subscription billing with seat limits, free and Pro plan enforcement. V1 excludes: GitLab and Bitbucket support, AI-suggested inline code fix suggestions (comments only), custom LLM fine-tuning, self-hosted or Docker deployment, mobile app, white-label offering, Jira/Linear integration, review analytics or trend reporting.

Success Definition

A remote engineering team installs the GitHub App, opens a PR, and receives a structured AI review comment with zero founder involvement — then upgrades to Pro without being asked.

Challenges

Distribution is the hard part — devs are skeptical of AI review noise. Winning trust requires the first review to feel eerily accurate, not generic. Nail prompt quality before marketing.

Avoid These Pitfalls

Do not post noisy, low-confidence comments — one false 'blocker' that wastes an engineer's time will kill word-of-mouth. Tune Claude prompts ruthlessly on 50 real PRs before launch, and default to 'warning' rather than 'blocker' when confidence is ambiguous. Do not ignore GitHub App secondary rate limits — at scale, fan-out across many repos with large diffs can exhaust the 5,000 requests/hour ceiling. Implement exponential backoff and per-installation request budgeting inside the Inngest job from day one. Do not store raw source code diffs in Supabase long-term — only store the review output metadata. This avoids GDPR data minimization issues and reduces DB storage costs, and must be stated clearly in the privacy policy to win enterprise trust.

Security Requirements

Verify GitHub webhook HMAC-SHA256 signature on every inbound request and return 401 immediately on mismatch — this is the primary defense against spoofed review triggers. Enforce Supabase Row Level Security on all tables scoped to org membership so no user can read another org's repos or reviews. Store all secrets (GitHub App private key, Claude API key, Stripe webhook secret) in Vercel environment variables, never commit to repo. Rate limit the webhook endpoint to 200 requests/minute per GitHub App installation ID. Verify Stripe webhook signatures before processing any billing state changes.

Infrastructure Plan

Host the Next.js app on Vercel (Pro plan for longer function timeouts needed by the webhook handler), use Supabase for Postgres and Auth, Inngest Cloud for the background job queue with automatic retries and observability, GitHub Actions for CI running ESLint and TypeScript type-checks on every push, and Sentry for error tracking and performance monitoring from day one.

Performance Targets

AI review comment posted within 90 seconds of PR webhook receipt at the 95th percentile. Dashboard page cold load under 2 seconds. Webhook handler must respond HTTP 200 in under 200ms (job is enqueued async, not processed inline). System must handle 50 simultaneous inbound PR webhooks without Inngest queue backup exceeding 30 seconds. Target 500 DAU at month 6 launch scale.