Code execution via eval() on model output
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
Pick Copilot code review if your team already pays for Copilot and wants it to review every pull request on GitHub. Pick OhMyBug if you want a bug hunt before you merge or push: $4 when it finds a bug, $0 when the code is clean.
Copilot code review Each review uses AI Credits
10 of 10 reviews use credits
OhMyBug Charged only when a review finds a bug
3 of 10 reviews charged
| Topic | OhMyBug | Copilot code review |
|---|---|---|
| You pay for | A review that finds a medium or worse bug: $4. A clean review: $0 | AI Credits for each review (1 AI Credit = $0.01), plus Actions minutes on private repositories |
| Where it reviews | Any change your coding agent can see, with or without a pull request | GitHub, its CLI and mobile app, VS Code, Visual Studio, Xcode, and JetBrains IDEs |
| Where it runs | Our cloud sandbox | GitHub Actions |
Copilot code review facts as of November 10, 2026. The sourced facts are in the full table.
OhMyBug #1 on ReviewBench · snapshot October 25, 2026
Our precision is lower than Copilot code review on ReviewBench. Each finding is checked by your own Claude or Codex, against your repository, before you act on it.
Copilot code review · Max #8 on ReviewBench · snapshot October 16, 2026
Grounded scores from review-bench.ai, pulled November 11, 2026. The Copilot code review row is its Max configuration (effort=high).
eval() on model outputOhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~14 months before the fix.
GHSA-mchm-gjx6-7h55 · advisory published September 24, 2026
From the replays on our home page; advisories checked November 10, 2026.
A review costs $4 when it finds a medium, high, or critical bug. Clean reviews, minor-only reviews, and findings your agent rejects cost $0. Your first bug-finding review is free. How billing works
On CI billing a hunt bills when it finds a medium-or-worse bug, checked or not (CI billing).
Copilot code review is billed in AI Credits (1 credit = $0.01), and each review on a private repository also uses GitHub Actions minutes. Source
The hunt runs in our cloud. Then the coding agent on your machine checks every finding against your repository and marks it REAL or NOT REAL, with a reason. You approve the verdicts.
$4 for a fast review that finds a bug. A deep hunt runs only when you choose it, and the offer shows the price first: $12, or $24 on a very wide change. One bug or ten costs the same.
OhMyBug is ranked #1 on open ReviewBench (review-bench.ai). See real bugs it found this week in the Bugarium.
GitHub Copilot code review facts as of November 10, 2026, quoted from its public pages
| Topic | OhMyBug | Copilot code review |
|---|---|---|
| Price | Fast review: $4 when it finds a medium or worse bug, $0 when clean. A deep hunt runs only when you choose it: $12, or $24 on a very wide change. | Billed as AI Credits under usage-based billing; 1 AI credit = $0.01. Plans include Copilot Pro at $10 per month and Pro+ at $39 per month. changelog pricing plans |
| Where it reviews | Any change your coding agent can see: a branch, uncommitted changes, recent commits, or a folder with no git. In CI, the OhMyBug CLI. | GitHub.com, GitHub CLI, GitHub Mobile, VS Code, Visual Studio, Xcode, JetBrains IDEs, and Azure DevOps (public preview). docs |
| Where the review runs | Our cloud sandbox. No self-hosting. The diff and the files the reviewers ask for are sent there; what is kept and for how long. | GitHub Actions: each review on a private repository uses Actions minutes; self-hosted runners do not consume them. changelog docs |
It can be, if you would rather pay per review that finds a bug. As of November 10, 2026, GitHub bills each Copilot code review in AI Credits, and reviews on private repositories also use GitHub Actions minutes. OhMyBug charges $4 for a review that finds a medium or worse bug and $0 for a clean one. Some teams use both: a reviewer on every pull request, and a bug hunt before a risky merge.
Yes. OhMyBug has no seat fee and no monthly plan. You add credit, and a review costs $4 when it finds a medium, high, or critical bug. Your first bug-finding review is free, with no card.
No, per review. One bug or ten costs the same $4. A clean review, or one with only minor findings, costs $0.
The review gives each finding a severity and a failure scenario. Your coding agent checks every finding in your repository and marks it REAL or NOT REAL, and you approve the verdicts. Findings it rejects cost nothing. On CI billing there is no confirm step. The full rules are in the FAQ.
No. Your coding agent can send a branch, uncommitted changes, your last commits, or a folder with no git. If you commit straight to main, ask it to hunt bugs in your last few commits.
The diff and the files the reviewers ask for go to our cloud sandbox. Submitted files are removed from the database after the sandbox receives them. Run transcripts are kept for 7 days after a completed review and 30 days after a failed one. Submissions are not used to train models. Details: How it works.
As of November 10, 2026, GitHub's changelog says each Copilot code review is billed as AI Credits, and reviews on private repositories also use GitHub Actions minutes.
Claude Code:
claude plugin marketplace add OhMyX-AI/ohmybug-plugin
claude plugin install bughunter@ohmybug
Codex (the update runs last):
codex plugin marketplace add OhMyX-AI/ohmybug-plugin
codex plugin add bughunter@ohmybug
codex mcp login ohmybug
codex update
Then say "hunt bugs" in your project. First bug-finding review free. No card.
Start free review →GitHub Copilot code review and other product names on this page belong to their owners and are used only to identify those products. Facts about GitHub Copilot code review are quoted from its public pages as of November 10, 2026 and may have changed since; follow the source links for the current terms.