Lessons from reviewing 50,000 pull requests with an agent

After processing 50k PRs across 200+ repos, here are the findings that surprised us:\n\n**Most bugs are boring.** Off-by-one errors, unhandled nulls, missing await. Not architectural failures. The top 5 bug categories account for ~60% of all issues found.\n\n**Security issues cluster by framework.** Rails apps have different vulnerability patterns than Express apps. Training a generic reviewer is harder than training framework-specific reviewers.\n\n**Developers reject ~30% of AI suggestions.** That's not a failure — that's correct calibration. The suggestions that get rejected are usually technically right but contextually wrong.\n\n**The best use case isn't catching bugs.** It's enforcing consistency. Style, naming, error handling patterns — the stuff that doesn't block merges but degrades codebases over time.