Why review bots get ignored, and what a grounded review does instead

Three habits that get a bot muted

One: comments without evidence. A finding that names a class but cannot point at the file, the line, and the code it accuses is a rumor, and an author with fifteen minutes will not chase it. Two: noise on clean pull requests. A bot that posts the same boilerplate on every run trains the reader that the comment carries no information. Three: unverifiable severity. When a low-confidence pattern match and a traced, reachable vulnerability arrive in the same shape, the reader cannot triage, so both get ignored.

Say nothing unless you can point at the line

The rule that fixes the first habit is mechanical, not aspirational: a finding publishes only when its quoted snippet matches, verbatim and uniquely, lines the pull request actually added, checked against the diff by code, not by judgment. A paraphrased or misplaced quote discards the finding, even a real one. Pre-existing code beside a touched line can never publish, because the author is answerable for their diff, not for the whole repository.

That is why the inline comment sits on the added line: the reader sees their own code, the accused statement, and the missing control in one glance, with the attacker, the input they control, the path to the sink, and the consequence written out. Two minutes of reading, no archaeology.

Silence is a result

A clean pull request gets one advisory Check and no comment, because silence on an uncertain change is a correct outcome, not a failure. A new review, which is what sends the author a notification, goes out only for new findings at medium severity or above, and inline comments only at high or above. The same finding is never announced twice. Nothing blocks a merge; the review is a signal, not a gate.

Unverified is not published

When a review cannot prove a lead but cannot dismiss it either, the lead is listed in the Check as unverified, at most five, never posted as an inline comment, and never counted as a clean result. At most five findings publish per review, most severe first, and the Check says when more were held back. A partial read is disclosed as partial, with the files not read and the reason, because a partial review sold as complete is the fastest way to lose a reader.

Publish the record

The last habit is the rarest: publishing the tool's failed runs next to its hits. ${RECEIPTS_CLEAN_LINE} The receipts page keeps the full transcript, every run appended as it happens, so the reader can check the posture instead of trusting the pitch.