Custom Review Rules

Your team's standards, in plain English, on every pull request. Describe a standard the way you would explain it to a teammate, scope it to the repositories and paths it covers, and CloudAEye checks it in every review.

Book a demo All use cases

Write the rule. CloudAEye enforces it.

Describe your team's standards in plain English. CloudAEye turns each description into an active rule that runs on every pull request review.

CloudAEyeCode Review / Rules

Rule

Rule description
"Verify that all API endpoints check user authentication before processing requests"
Status
Active
Repository scope
* All repositories
File scope
src/api/

On the next pull request

src/api/refunds.ts:27 payments-api #204

POST /refunds loads the order before it checks that the caller is authenticated.

Flagged by your rule: authentication enforcement.

The rule runs only on files under src/api/.

Every team has
unwritten rules.

Reviewers repeat the same comments on every pull request. Write them down once, in plain English, and CloudAEye holds every change to them, so reviewers can focus on what only people can judge.

Enforce standards in plain English.

Describe a rule the way you would explain it to a teammate. CloudAEye turns it into an active rule that runs on every pull request review.

  • WriteNatural language
  • ActivateOn or off per rule
  • Runs onEvery pull request review
See a rule at work

Scope each rule to the code it fits.

Apply a rule everywhere, or narrow it to specific repositories, file patterns, or subdirectories.

  • RepositoriesInclude or exclude
  • File patterns.py, src/api/
  • Subdirectoriesbackend/controllers/
Read the docs

Learn rules from past reviews.

Pick past pull requests, and CloudAEye turns your team's review comments into a rule you can check and save.

  • Learns fromPast PR comments
  • Leaves outAuthors you exclude
  • Goes liveAfter you review and save it
Read the docs

The same rules before the commit.

Rules also live in a .cloudaeye.rules file in your repository, so pre-commit reviews in your coding agent hold code to the same standards.

  • Organization rulesSynced by /cloudaeye:config
  • Your own rulesNever overwritten
  • Followed byinspect, security, review
See the rules file

Rules your team can start with.

Security

  • Prevent credential leaks"Flag any hardcoded API keys, passwords, or secret tokens"
  • SQL injection prevention"Ensure all database queries use parameterized statements instead of string concatenation"
  • Authentication enforcement"Verify that all API endpoints check user authentication before processing requests"
  • Input validation"Check that all the payload inputs are validated before processing the request"

Code quality

  • Error handling"All async functions must include try-catch blocks"
  • Resource cleanup"Ensure database connections and file handles are closed in finally blocks"
  • Specific exception handling"Flag bare except clauses that catch all exceptions without specificity"
  • Intentional error suppression"Ignore bare exceptions when used to skip part of the process and continue on unexpected errors"

Team standards

  • API logging"All external API calls must include logging for request and response"
  • Documentation"All public functions must have JSDoc comments explaining parameters and return values"

Rules that live with your code.

Keep rules in a .cloudaeye.rules file in your repository. Each rule is a heading, the rule in plain words, and the paths it applies to.

  • A rule covers the directory of its file and everything below it. Applies to narrows it to paths.
  • Rules add up from the root down. A change under services/payments/ follows the top-level rules and its own.
  • /cloudaeye:config syncs your organization's console rules into the top-level file. Rules you write yourself are never touched.
  • Pre-commit reviews and Ultrareview follow the file. Pull request reviews by the CloudAEye GitHub App follow the rules saved in the console.
.cloudaeye.rules
# Review rules

## No request bodies in logs
Never log a request or response body; log its size and the route instead.
- Applies to: `src/api/`

## Money is never a float
Amounts are integers in the smallest currency unit, or Decimal. Never float.
- Applies to: `services/payments/`, `services/billing/`