CodeRabbit

CodeRabbit

CodeRabbit reviews pull requests for defects, policy issues, and code quality.

Oximy ResearchUpdated 19 September 2026

Overview

A+
Transparency
6 / 10
Trust
99 / 100
Developer toolWalnut Creek, USCodeRabbit, Inc.

Trains on your data

Free
No
Paid
No
Opt-out
Not captured

Incidents

1
  • mediumCodeRabbit’s Production Servers RCE Vulnerability Enables Write Access on 1M Repositories
SOC 2ISO 27001GDPRHIPAA

Assessed SEP 21, 2026 · Checked by hand SEP 21, 2026

CodeRabbit confirms four compliance frameworks, prohibits customer-code training, uses provider zero data retention, and confirms one remediated vulnerability without customer exposure.

Trust breakdown

A+

99 / 100

Overall trust score

Data safetyComplianceIncidentsLegal
Data safety100
Compliance100
Incidents95
Legal100

Data and privacy

Trains on your data

No training on user data

Storage regions

United States

Sub-processors

AnthropicGoogle Cloud PlatformOpenAIDatadogsalesforceVantaGitHubLanceDBCloudflareVercel

Data retention

While the code is shared with Third-Party AI Model Providers, CodeRabbit has a zero data retention policy with each Third-Party AI Model Provider.

Deletion: We will use commercially reasonable efforts to honor your requests for deletion; however, certain residual information may actively persist on the Service even if you close your account.

Privacy policyTermsTrust center

Incidents

Powered by

OpenAI o3OpenAI o4-miniOpenAI GPT-4.1NVIDIA Nemotron 3 NanoAnthropic Claude-OpusAnthropic Claude-Sonnet

CodeRabbit uses a multi-model architecture, blending efficient open models for context gathering and frontier models (primarily from OpenAI and Anthropic) for review reasoning. They also integrate NVIDIA Nemotron for context summarization, especially for self-hosted customers.

Integrations and access

Integrations

API: YesGitHub MarketplaceAWS MarketplaceClaude MarketplaceJiraLinearNotionSentryAsanaMonday.comClickUpGitHub CopilotVS CodeAmazon ECSAmazon EKSJenkinsSonarQubeAzure DevOps

Available on

Web
iOS
Android
macOS
Windows
Linux
Extension
CLI

Pricing

Essentials

$24/developer/month

Agentic code reviews for every PR. Billed annually. $30/developer/month when billed monthly.

Team

$48/developer/month

All features in Essentials, plus multi-repo analysis, custom pre-merge checks, finishing touches (unit tests, merge conflict resolution, simplify), post-merge actions, and higher limits. Billed annually. $60/developer/month when billed monthly.

Advanced

$72/developer/month

Everything in Team, plus blast radius and architectural impact analysis, security review of every PR, continuous security monitoring, and higher limits. Billed annually. $90/developer/month when billed monthly.

Enterprise

Custom

Custom pricing. Includes all Advanced plan features, custom RBAC, SSO, audit logging, API access, self-hosting option, multi-org support, SLA support, technical enablement, dedicated CSM, pay via Claude/AWS/GCP marketplace, vendor security review and agreement redlines, custom setup including ALB, etc., and EU SaaS deployment. Billed annually.

View pricing page

Prices as listed on SEP 21, 2026; check the vendor's page.

Moat and openness

5/ 10
Moat 5 out of 10

Moat

  • Proprietary Model
  • Proprietary Data
  • Network Effects
  • Switching Costmoderate
  • Unique UX
  • Distributionmoderate

CodeRabbit leverages a sophisticated multi-model architecture and offers a comprehensive suite of features beyond basic code review, including security and planning tools, which provides some defensibility. However, its reliance on third-party LLMs and the absence of proprietary data or strong network effects limit its long-term moat. The switching cost is moderate due to integrations and workflow embedding, but not insurmountable.

5/ 10
Openness 5 out of 10

Openness

  • Open model weights
  • Published research
  • Open source contributions
  • Transparency reports
  • Public safety evals

CodeRabbit is not open source, and its code is not publicly available. The company is transparent about its data privacy practices, stating that customer code is not used for model training and outlining how data is shared with third-party services like OpenAI and Anthropic for review purposes. They also offer a free plan for open-source projects and commit significant resources to supporting the open-source community. While they provide detailed documentation and pricing transparency for their paid plans, the specifics of how their AI reviews are generated are considered proprietary. They have a privacy policy and a data protection officer.

Timeline

  1. 2024-08CodeRabbit raised $16 million in Series A funding.

Company

CodeRabbit Inc

Founded
2023
HQ
San Francisco, California, United States

Popularity

0

monthly visits

low tierlow risk

Notable customers

NVIDIABMWAdyenIndeedJFrogTrivago

CodeRabbit is expanding from AI code review into Agentic Change Management, launching Triage, Change Stack and CodeRabbit Security, and competes with companies like Qodo, Greptile, and CodeAnt AI in the growing global code review services market.

Value and ROI

What it should move: It shortens reviews and catches basic defects before merge.

Best fit

It fits teams with documented coding rules that want an automated first review.

The catch

Automated review comments can create noise or false confidence. Set repository permissions and review policies, and assign responsibility for merging changes.

  • Abnormal AI: Uses CodeRabbit for automated code review and policy checks across generated and human-written changes.[1]
  • LeoLabs: Uses CodeRabbit for pull-request feedback, edge-case review and security checks.[2]

In our stacks for

Engineering

References

  1. 01Abnormal AI: how it uses CodeRabbitCodeRabbitVendor-published
  2. 02LeoLabs: how it uses CodeRabbitCodeRabbitVendor-published
  3. 03Privacy policyCodeRabbit IncVendor-published
  4. 04TermsCodeRabbit IncVendor-published
  5. 05Trust centerCodeRabbit IncVendor-published
  6. 06Pricing pageCodeRabbit IncVendor-published
  7. 07Company siteCodeRabbit IncVendor-published
  8. 08SOC 2CodeRabbit IncVendor-published
  9. 09ISO 27001CodeRabbit IncVendor-published
  10. 10CodeRabbit’s Production Servers RCE Vulnerability Enables Write Access on 1M RepositoriesCodeRabbitIndependent