Code review practice for the AI era

The bug you can't spot today ships tomorrow.

Train before the incident, not after. One realistic AI pull request a day: leave inline comments, give a verdict, get graded against a canonical review. Free, no signup to try.

Review today's PR Browse the library →

100+ planted bugs6 stacks~5 min per review

diffdojo / python / checkout-discounts

Step 2 · Review+3 −1

Files

checkout/discounts.py +3 −1 tests/test_discounts.py +12 checkout/models.py +1

checkout/discounts.py +3−1

11def apply_coupon(cart, coupon):

2 if coupon.expires_at < datetime.now():

2 if coupon.expires_at <= datetime.now():

Yyou · just now

Boundary changed: a coupon expiring right now used to be valid. Intentional?

33 return cart.total

4 if coupon.minimum_total:

5 return cart.total - coupon.amount

46 return max(0, cart.total - coupon.amount)

The brief

Expired coupons must never apply.
Respect minimum_total when set.
Totals never go below zero.

Your comments · 1

Request changesApprove

Living benchmark

Frontier models catch most of our planted bugs. The ones they miss are the expensive ones.

73%

Recall on security bugs for one frontier model, on the same PRs you review here. Across all models and categories it runs from 86% to 98%. Every miss still lands on a human's desk with a green check.

See the full benchmark →

Claude Sonnet 5

98%

Qwen 3.8 Max

95%

GPT-5.6 Sol

94%

Gemini 3.8 Flash

90%

DeepSeek V4 Pro

86%

Recall over 176 planted issues in 202 public PRs, September 2026 run.

Why train

AI writes the code. Fixing is what it does for you. Judgment stays yours.

Every AI pull request that merges went past a human who said yes. The review is the last gate, and it is only as good as the reviewer's eye for the broken assumption.

Spot it before it ships

Realistic PRs with planted bugs in the classes that actually cause incidents: auth bypass, lost pennies, tests that assert nothing. Miss it here, not in production.

Make it a habit

Five minutes a day. Every review is graded against what a strong reviewer would have caught, and your profile shows which bug classes keep slipping past you.

See your team's blind spots

The same profile across everyone who reviews. Who approves deceptive tests, who never flags security, where the next incident is most likely to come from. Before it does.

Start training DiffDojo for teams →

How it works

The judgment loop, without waiting for a teammate's PR.

Daily practice built on the loop reviewers already run at work. Read, decide, learn what a strong review would have caught.

step 1 / 3

Read the PR

The requirements it claims to meet, then the diff. Like a normal review.

imports every userreports success only when done

step 2 / 3

Comment and decide

Flag the broken lines, then approve or request changes. Clean code exists, and approving it counts.

Request changesApprove

step 3 / 3

See what you missed

Rubric-based grading and the canonical review, side by side with yours.

caught the racemissed the zero floor

What you'll train

Code that looks plausible and hides a real defect.

Hand-authored PRs across React, Angular, Node and Python. Each one is a self-contained exercise with a canonical review to compare against.

01SecurityThe leaked secret, the unchecked lookup, the injected bio, the SQL string. 02Requirement fidelityPlausibly similar to the spec. Not the spec. 03Edge cases and errorsThe malformed row, the empty list, the silent reject. 04Hallucinated APIsMethods and arguments that read perfectly and don't exist. 05State and data flowStale closures, effects that never clean up, leaked subscriptions. 06PerformanceCorrect-but-quadratic code, N+1 queries, defeated memoization. 07Data correctnessMoney as floats, dates that drift a timezone, lost pennies. 08Deceptive testsGreen suites that assert nothing, or mock away the rule. 09Over-engineeringThe registry for two constants, abstractions nobody asked for.

FAQ

Short answers before you click.

What is in DiffDojo today?

As of October 2026: 299 live practice PRs (98 Python, 60 Node, 47 Angular, 46 React, 23 Go, 23 Java, 2 COBOL), most with a planted bug, each graded against a canonical review. Free for individuals. For teams: a 30-day free pilot with 5 seats, then €300 per team per month up to 8 seats and €30 per extra seat.

What is DiffDojo?

A code review trainer: you review realistic AI-generated pull requests with planted bugs, leave inline comments, give a verdict, and get graded against a canonical review. Like LeetCode, but for reading code instead of writing it.

Is DiffDojo free?

Yes. The daily challenge and the full library are free, no signup needed. An account only saves your progress.

How is my review graded?

Most PRs hide a planted bug and some are clean. A bug comes with a rubric your inline comments are matched against; a clean PR with the reason it is fine. Your verdict is checked, and you see the canonical review next to yours.

What stacks are the PRs in?

Python, React, Angular, Node (JavaScript/TypeScript), Java and Go today. More stacks join the library as it grows.

How is this different from LeetCode?

LeetCode trains writing code. DiffDojo trains reviewing it: reading a diff, catching the planted bug, and defending a verdict.

Is the code really AI-written?

Yes. Each PR is generated by an AI assistant, then curated by hand so any planted bug is realistic and the canonical review is defensible.

How long does a review take?

About five minutes for the daily PR. One small diff, one verdict, instant feedback.

From the blog

Reviewing AI code, one failure mode at a time.

GuideHow to review AI-generated codeThe six failure modes to check on every AI-written PR, with a diff you can test yourself on. SecuritySlopsquatting: the attack your review should catchAI package hallucinations are becoming supply chain attacks. The reviewer is the last line of defense. PracticeA LeetCode alternative for code reviewThe few places that train reading code instead of writing it, and what each one is good for.

All posts →

The AI says it's clean. Prove it wrong.

One PR, one verdict, five minutes. Free, no account needed.

Review today's PR Browse the library