Two reviewers. One found nothing.
This is a real Veridu review of a real pull request, shown exactly as it came back. Nothing on this page is running — it is the stored result of one run against fastify/fastify#6965, a two-file change of +42/−2 lines that fixes a 404-handler bug.
Same diff, same instructions, same moment. One reviewer read this change and had nothing to say about it. Had you run only that one — which is what every single-model reviewer is — this page would be blank.
Object.create-based context breaks own-property enumeration semantics
Switching _404Context from a shallow copy (Object.assign({}, …)) to a prototype-linked object (Object.create(…)) means hooks inherited from instance[kFourOhFourContext] are no longer own enumerable properties of _404Context. Any code elsewhere that enumerates the context via Object.keys(), JSON.stringify(), object spread, or Object.assign(target, _404Context) will silently omit the inherited hooks (preHandler, preValidation, etc.), even though direct property access (context.preHandler) still works via the prototype chain.
- line 78: `const _404Context = Object.create(instance[kFourOhFourContext])` replaces the prior `Object.assign({}, instance[kFourOhFourContext])`
- Object.create sets its argument as the prototype, not as own properties, of the new object
- Only `onSend` is explicitly assigned as an own property on `_404Context`
If any consumer of the 404 context object relies on own-property enumeration (Object.keys, spread, JSON serialization) rather than direct property access, the fix will silently drop inherited lifecycle hooks for such code paths, reintroducing a variant of the bug being fixed.
Veridu keeps those two apart on every finding. A reviewer that cannot show what it verified is asking to be believed, and the fastest way to lose a team is a confident wrong answer with no way to check it.
So we adjudicated every finding across 10 pull requests of a production codebase by hand. Of 44 findings judged real, only 4 were found by both models — 9.1% overlap. 40 were real and unique to one reviewer, against 2 false positives.
That is a small sample, self-adjudicated, on one codebase — so treat it as ours, not as a benchmark. An independent run of four reviewers across 146 merged pull requests found 93.4% of issues caught by exactly one reviewer and none by all four, and concluded that a second reviewer is additive rather than duplicative. Different tools, different codebase, same shape.
Public repos need nothing but the URL. Private ones stay private — connect a repo, or run the CLI locally against your own API keys.
npm install -g veridu · veridu review <pr-url>