# AI code review
Source: https://docs.infraista.com/en/developer-tools/code-security/ai-code-review



AI code review reads **your own code** for injection, broken authorization, insecure crypto and similar
flaws. It explains each issue and suggests a patch. It's off by default and set per repository.

AI findings are **suggestions**: they're labeled, they never block the gate, and they don't trigger the
"new Critical or High" alert. Review them as you would a teammate's pull request.

## Turn it on [#turn-it-on]

1. Open the repository in **Code Security** and go to **Settings** > **AI code review**.
2. Turn on **AI code review** and choose:
   * **Sensitivity**: **Low** (only the findings it's most sure about), **Balanced**, or **Strict** (more
     findings, including weaker signals, and more false positives).
   * **Languages to review**: JavaScript / TypeScript, Python, Go, PHP.
   * **Max files per scan**: 10 to 1,000. Full scans review the most recently changed files first.
   * **Check whether vulnerable dependencies are reachable** (needs the Dependencies scanner).
3. Save. It applies from the next scan.

On a pull request, only the changed files are reviewed.

## Read an AI finding [#read-an-ai-finding]

An AI finding shows the flagged lines, the AI's explanation (switch between **Short** and **Detailed**
with **Explain differently**), its confidence, the weakness (CWE and OWASP Top 10), and a **Suggested
patch**.

* **Apply as pull request** (owners and admins) applies the patch on a new branch and opens a draft
  pull request. Nothing is merged until someone on your team reviews and merges it. If the code has
  changed and the patch no longer applies, use the prompt instead.
* **Fix with your AI assistant** gives a prompt to paste into the coding assistant you use in your
  editor or terminal.
* Rate it **Helpful**, **Not helpful** or **False positive**. To stop seeing a false positive, ignore it
  with the reason **False positive**.

## Reachability [#reachability]

With reachability on, AI review looks for calls to the vulnerable code of serious dependency findings,
and marks each one **Reachable**, **Not reachable** or **Unknown**, with the call path it followed. AI
can be wrong, so check the call path before you rely on it.

## How your code is handled [#how-your-code-is-handled]

Files are sent to the model for the review only. They aren't stored or used for training. A short
excerpt around each finding and the suggested patch are kept with the finding.

## Cost [#cost]

AI review is billed by the tokens it uses, per scan; **Explain differently** uses tokens too. See
[Billing and retention](/en/developer-tools/code-security/billing-and-retention).

## Related [#related]

* [Work with findings](/en/developer-tools/code-security/work-with-findings)
* [Billing and retention](/en/developer-tools/code-security/billing-and-retention)