OhMyBugCode execution via eval() on model output
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
OhMyBug vs CodeRabbit
Pay per seat every month, or pay per review that finds a bug?
Pick CodeRabbit if you want a review bot on every pull request for a monthly price per developer. Pick OhMyBug if you want a bug hunt before you merge or push: $4 when it finds a bug, $0 when the code is clean.
CodeRabbit A seat for each developer, each month
8 seats
- seat
- seat
- seat
- seat
- seat
- seat
- seat
- seat
OhMyBug Charged only when a review finds a bug
3 of 10 reviews charged
- $0 clean
- $4 bug
- $0 clean
- $0 clean
- $4 bug
- $0 clean
- $0 clean
- $0 clean
- $4 bug
- $0 clean
At a glance
| Topic | OhMyBug | CodeRabbit |
|---|---|---|
| You pay for | A review that finds a medium or worse bug: $4. A clean review: $0 | A developer seat per month: $30 on Essentials, or $24 billed annually |
| Where it reviews | Any change your coding agent can see, with or without a pull request | Pull requests on GitHub, GitLab, Azure DevOps, and Bitbucket; pre-commit from the command line |
| Where it runs | Our cloud sandbox | CodeRabbit's cloud, or self-hosted on Enterprise |
CodeRabbit facts as of November 10, 2026. The sourced facts are in the full table.
Quality on ReviewBench
OhMyBug #1 on ReviewBench · snapshot October 25, 2026
Each finding is checked by your own Claude or Codex, against your repository, before you act on it.
No public ReviewBench result for CodeRabbit as of November 11, 2026.
Grounded scores from review-bench.ai, pulled November 11, 2026.
Caught before the fix
Code execution via
Auth middleware bypass via the tunnel-route prefix
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~14 months before the fix.
GHSA-mchm-gjx6-7h55 · advisory published September 24, 2026
From the replays on our home page; advisories checked November 10, 2026.
How OhMyBug is different
$0 for a clean review. $4 when it finds a bug.
A review costs $4 when it finds a medium, high, or critical bug. Clean reviews, minor-only reviews, and findings your agent rejects cost $0. Your first bug-finding review is free. How billing works
On CI billing a hunt bills when it finds a medium-or-worse bug, checked or not (CI billing).
CodeRabbit Essentials: $30 per developer per month, or $24 billed annually. Source
Your own Claude or Codex checks each finding.
The hunt runs in our cloud. Then the coding agent on your machine checks every finding against your repository and marks it REAL or NOT REAL, with a reason. You approve the verdicts.
Fixed price per review. No seat count.
$4 for a fast review that finds a bug. A deep hunt runs only when you choose it, and the offer shows the price first: $12, or $24 on a very wide change. One bug or ten costs the same.
Who should pick which
CodeRabbit fits teams that
- want a review on every pull request, on GitHub, GitLab, Azure DevOps, or Bitbucket
- prefer one monthly price per developer
- need it inside their own infrastructure (self-hosting, on Enterprise)
OhMyBug fits developers who
- write code with Claude Code or Codex and want a bug hunt before they merge or push
- commit straight to main, or work on a branch, uncommitted changes, or a folder with no git
- want to pay per review, and $0 for a clean one
OhMyBug is ranked #1 on open ReviewBench (review-bench.ai). See real bugs it found this week in the Bugarium.
The facts, side by side
CodeRabbit facts as of November 10, 2026, quoted from its public pages
| Topic | OhMyBug | CodeRabbit |
|---|---|---|
| Price | Fast review: $4 when it finds a medium or worse bug, $0 when clean. A deep hunt runs only when you choose it: $12, or $24 on a very wide change. | Essentials: $30 per developer per month, or $24 billed annually. Team: $60, or $48 billed annually. pricing |
| Where it reviews | Any change your coding agent can see: a branch, uncommitted changes, recent commits, or a folder with no git. In CI, the OhMyBug CLI. | GitHub, GitLab, Azure DevOps, and Bitbucket. Pre-commit reviews from the command line. docs |
| Where the review runs | Our cloud sandbox. No self-hosting. The diff and the files the reviewers ask for are sent there; what is kept and for how long. | CodeRabbit's cloud, or self-hosted for Enterprise customers. self-hosted |
| Training on your code | Submissions are not used to train models. | "CodeRabbit never uses customer code for model training." FAQ |
Questions
Is OhMyBug a CodeRabbit alternative?
It can be, if you would rather pay per review that finds a bug. CodeRabbit lists Essentials at $30 per developer per month, or $24 billed annually. OhMyBug charges $4 for a review that finds a medium or worse bug and $0 for a clean one. Some teams use both: a reviewer on every pull request, and a bug hunt before a risky merge.
Is there AI code review without a subscription?
Yes. OhMyBug has no seat fee and no monthly plan. You add credit, and a review costs $4 when it finds a medium, high, or critical bug. Your first bug-finding review is free, with no card.
Does OhMyBug charge per bug?
No, per review. One bug or ten costs the same $4. A clean review, or one with only minor findings, costs $0.
Who decides what counts as a bug?
The review gives each finding a severity and a failure scenario. Your coding agent checks every finding in your repository and marks it REAL or NOT REAL, and you approve the verdicts. Findings it rejects cost nothing. On CI billing there is no confirm step. The full rules are in the FAQ.
Do I need a pull request to use OhMyBug?
No. Your coding agent can send a branch, uncommitted changes, your last commits, or a folder with no git. If you commit straight to main, ask it to hunt bugs in your last few commits.
What leaves my machine?
The diff and the files the reviewers ask for go to our cloud sandbox. Submitted files are removed from the database after the sandbox receives them. Run transcripts are kept for 7 days after a completed review and 30 days after a failed one. Submissions are not used to train models. Details: How it works.
Can CodeRabbit review code before I push?
CodeRabbit's docs describe pre-commit reviews from the command line, as of November 10, 2026.
Try it on your next change
Claude Code:
claude plugin marketplace add OhMyX-AI/ohmybug-plugin
claude plugin install bughunter@ohmybugCodex (the update runs last):
codex plugin marketplace add OhMyX-AI/ohmybug-plugin
codex plugin add bughunter@ohmybug
codex mcp login ohmybug
codex updateThen say "hunt bugs" in your project. First bug-finding review free. No card.
Start free review →CodeRabbit and other product names on this page belong to their owners and are used only to identify those products. Facts about CodeRabbit are quoted from its public pages as of November 10, 2026 and may have changed since; follow the source links for the current terms.