Code execution via eval() on model output
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
Pick Qodo if you want several review agents on every pull request, with a cloud, single-tenant, or on-premises option. Pick OhMyBug if you want a bug hunt before you merge or push: $4 when it finds a bug, $0 when the code is clean.
Qodo Each review draws credits from a monthly pool
10 of 10 reviews draw credits
OhMyBug Charged only when a review finds a bug
3 of 10 reviews charged
| Topic | OhMyBug | Qodo |
|---|---|---|
| You pay for | A review that finds a medium or worse bug: $4. A clean review: $0 | Credits from a monthly pool; credits expire at the end of each cycle |
| Where it runs | Our cloud sandbox | Multi-tenant cloud, a single-tenant VPC, or on-premises |
Qodo facts as of November 10, 2026. The sourced facts are in the full table.
OhMyBug #1 on ReviewBench · snapshot October 25, 2026
Our precision is lower than Qodo on ReviewBench. Each finding is checked by your own Claude or Codex, against your repository, before you act on it.
Qodo #14 on ReviewBench · snapshot September 28, 2026
Grounded scores from review-bench.ai, pulled November 11, 2026.
eval() on model outputOhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~14 months before the fix.
GHSA-mchm-gjx6-7h55 · advisory published September 24, 2026
From the replays on our home page; advisories checked November 10, 2026.
A review costs $4 when it finds a medium, high, or critical bug. Clean reviews, minor-only reviews, and findings your agent rejects cost $0. Your first bug-finding review is free. How billing works
On CI billing a hunt bills when it finds a medium-or-worse bug, checked or not (CI billing).
Qodo meters reviews in credits: every code review draws credits from your monthly pool, and credits expire at the end of each cycle. Source
The hunt runs in our cloud. Then the coding agent on your machine checks every finding against your repository and marks it REAL or NOT REAL, with a reason. You approve the verdicts.
$4 for a fast review that finds a bug. A deep hunt runs only when you choose it, and the offer shows the price first: $12, or $24 on a very wide change. One bug or ten costs the same.
OhMyBug is ranked #1 on open ReviewBench (review-bench.ai). See real bugs it found this week in the Bugarium.
Qodo facts as of November 10, 2026, quoted from its public pages
| Topic | OhMyBug | Qodo |
|---|---|---|
| Price | Fast review: $4 when it finds a medium or worse bug, $0 when clean. A deep hunt runs only when you choose it: $12, or $24 on a very wide change. | Credits from a monthly pool. Smaller PRs draw fewer credits, larger or more complex reviews draw more. Credits expire at the end of each monthly cycle. pricing |
| Where the review runs | Our cloud sandbox. No self-hosting. The diff and the files the reviewers ask for are sent there; what is kept and for how long. | Multi-tenant cloud by default; a single-tenant instance in your own VPC; or on-premises. deployment |
| Training on your code | Submissions are not used to train models. | "Qodo does not train models on your code." pricing |
It can be, if you would rather pay per review that finds a bug. Qodo meters reviews in credits drawn from a monthly pool, and larger or more complex reviews draw more. OhMyBug charges $4 for a review that finds a medium or worse bug and $0 for a clean one. Some teams use both: a reviewer on every pull request, and a bug hunt before a risky merge.
Yes. OhMyBug has no seat fee and no monthly plan. You add credit, and a review costs $4 when it finds a medium, high, or critical bug. Your first bug-finding review is free, with no card.
No, per review. One bug or ten costs the same $4. A clean review, or one with only minor findings, costs $0.
The review gives each finding a severity and a failure scenario. Your coding agent checks every finding in your repository and marks it REAL or NOT REAL, and you approve the verdicts. Findings it rejects cost nothing. On CI billing there is no confirm step. The full rules are in the FAQ.
No. Your coding agent can send a branch, uncommitted changes, your last commits, or a folder with no git. If you commit straight to main, ask it to hunt bugs in your last few commits.
The diff and the files the reviewers ask for go to our cloud sandbox. Submitted files are removed from the database after the sandbox receives them. Run transcripts are kept for 7 days after a completed review and 30 days after a failed one. Submissions are not used to train models. Details: How it works.
As of November 10, 2026, Qodo's pricing page says a credit is the unit it uses to meter review activity, and every code review draws credits from your monthly pool.
Claude Code:
claude plugin marketplace add OhMyX-AI/ohmybug-plugin
claude plugin install bughunter@ohmybug
Codex (the update runs last):
codex plugin marketplace add OhMyX-AI/ohmybug-plugin
codex plugin add bughunter@ohmybug
codex mcp login ohmybug
codex update
Then say "hunt bugs" in your project. First bug-finding review free. No card.
Start free review →Qodo and other product names on this page belong to their owners and are used only to identify those products. Facts about Qodo are quoted from its public pages as of November 10, 2026 and may have changed since; follow the source links for the current terms.