Backlog

Next up

In Progress

Done

Main Roadmap

Planned

High Priority

Cora Usage not read from server

Code Cora Team

Description:Stricter rate limits on authentication endpoints prevent brute force attacks and credential stuffing.Problem it solves:Auth endpoints are prime targets for attacks. Standard rate limits are too lenient for login/signup flows.Key features:<ul><li>Lower threshold for auth endpoints</li><li>IP-based limiting</li><li>Account lockout after failures</li><li>Gradual unlock periods</li></ul>

Completed

Authentication Rate Limiting

Description:Input validation for AI provider URLs prevents Server-Side Request Forgery attacks. Users can only connect to allowed AI providers.Problem it solves:Custom AI endpoints could be exploited to make the server access internal resources or malicious URLs.Key features:<ul><li>URL validation and sanitization</li><li>Blocked private IP ranges</li><li>Allowed domain whitelisting</li><li>Protocol restrictions (HTTPS only)</li></ul>

SSRF Protection

Description:Redis-backed rate limiting with in-memory fallback. Protects the platform from abuse and ensures fair usage.Problem it solves:Without rate limiting, a single user or bot could overwhelm the system, affecting all users.Key features:<ul><li>Redis-backed distributed limiting</li><li>In-memory fallback for resilience</li><li>Configurable limits per endpoint</li><li>Graceful degradation</li></ul>

Rate Limiting

Description:Your code is never stored permanently on CORA servers. Code is processed in memory and discarded immediately after review.Problem it solves:Security-conscious organizations are concerned about code being stored on third-party servers.Key features:<ul><li>In-memory processing only</li><li>No persistent code storage</li><li>Immediate data deletion post-review</li><li>Privacy-first architecture</li></ul>

Zero Code Retention

Description:Only changed lines are analyzed, not entire files. This makes reviews 100x more efficient in terms of tokens and cost.Problem it solves:Reviewing entire files wastes tokens and money. Most PRs only change a small portion of files.Key features:<ul><li>Unified diff parsing</li><li>Context-aware analysis</li><li>Massive token savings</li><li>Faster review times</li></ul>

Diff-Only Analysis

Description:Switch between OpenAI, Anthropic, Groq, and custom providers. Use the best AI for each task or optimize for cost.Problem it solves:Different AI models excel at different tasks. Teams want flexibility to choose models based on cost, speed, or capability.Key features:<ul><li>OpenAI (GPT-4, GPT-4-turbo, GPT-3.5)</li><li>Anthropic (Claude 3 Opus, Sonnet, Haiku)</li><li>Groq (Llama 3, Mixtral)</li><li>Custom endpoints (Ollama, vLLM, etc.)</li><li>Per-review model selection</li></ul>

Multi-Provider AI

Description:Monitor AI token usage and costs per workspace. Understand your spending and optimize AI usage.Problem it solves:AI API costs can spiral without visibility. Teams need to track usage for budgeting and optimization.Key features:<ul><li>Real-time token counting</li><li>Cost estimation per provider</li><li>Usage breakdown by repository</li><li>Historical trends</li></ul>

Token Tracking

Description:Organize repositories by team, project, or client. Each workspace has its own settings, API keys, and usage tracking.Problem it solves:Managing a growing number of repositories becomes chaotic. Teams need logical grouping and isolated configurations.Key features:<ul><li>Multiple workspaces per account</li><li>Repository assignment</li><li>Per-workspace AI settings</li><li>Isolated usage tracking</li></ul>

Workspaces

Description:Automatic code review on every <code>git commit</code>. Catch issues before they even reach your pull request.Problem it solves:Reviewing code after pushing means wasted CI minutes and longer feedback loops. Pre-commit reviews catch issues instantly.Key features:<ul><li>Automatic hook installation</li><li>Configurable review triggers</li><li>Fast feedback loop</li><li>Blocks commits with critical issues (optional)</li></ul>Setup:<pre><code class="language-warp-runnable-command">cora hooks install
# Now every commit triggers a review</code></pre>

CLI - Pre-commit Hooks

Description:Flexible output formats for different use cases: pretty (terminal), JSON (automation), compact (summary), and SARIF (security tools).Problem it solves:Different workflows require different output formats. Developers need human-readable output while CI/CD systems need machine-readable formats.Key features:<ul><li>pretty - Color-coded terminal output with emojis</li><li>json - Structured JSON for automation and scripting</li><li>compact - Minimal summary for quick reviews</li><li>sarif - Static Analysis Results Interchange Format for security tools</li></ul>Usage:<pre><code class="language-warp-runnable-command">cora review --format json
cora review --format sarif &gt; results.sarif</code></pre>