Head to head
Compare two models
Same 30 PRs, same goldens — which bugs did one find that the other missed?
53both found
0only Gemini 3.7 Flash
3only MiniMax M3
39neither found
Per-PR diff (30)
Keycloak · Javaadd-caching-support-for-identityproviderstorageprovider-getforlogin-operations-keycloak1 disagree · 2 goldens
CriticalRecursive caching call using session instead of delegateGemini 3.7 Flash missed it · MiniMax M3 found it
MediumCleanup reference uses incorrect alias - should be 'idp-alias-' + i instead of 'alias'.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Keycloak · Javaadd-client-resource-type-and-scopes-to-authorization-schema-keycloakagree · 3 goldens
HighInconsistent feature flag bug causing orphaned permissions. The AdminPermissions event listener, responsible for cleaning up permissions upon role, client, or group removal, is incorrectly guarded by the ADMIN_FINE_GRAINED_AUTHZ (V1) feature flag. This is inconsistent with other methods in the class that use ADMIN_FINE_GRAINED_AUTHZ_V2. Consequently, if ADMIN_FINE_GRAINED_AUTHZ_V2 is enabled but V1 is not, the permission cleanup logic will not execute, leading to orphaned permission data. Cleanup should occur regardless of which fine-grained authorization version is enabled.Gemini 3.7 Flash found it · MiniMax M3 found it
HighIn hasPermission(ClientModel client, String scope), the resource lookup uses findByName(server, client.getId(), server.getId()), but AdminPermissionsSchema.getOrCreateResource creates per-client resources with the owner set to resourceServer.getClientId(), so this lookup will never find those resources and will always fall back to the 'all-clients' resource, effectively ignoring client-specific permissions.Gemini 3.7 Flash found it · MiniMax M3 found it
HighIn getClientsWithPermission(String scope), iterating resourceStore.findByType(server, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE) and returning resource.getName() will only ever consider the type-level 'Clients' resource (per-client resources have no type) and return its name, while AvailableRoleMappingResource#getRoleIdsWithPermissions expects actual client IDs to pass to realm.getClientById, which can lead to incorrect behavior or a null client and subsequent failures.Gemini 3.7 Flash found it · MiniMax M3 found it
cal.com · TypeScriptadd-guest-management-functionality-to-existing-bookings-cal-comagree · 5 goldens
HighCase sensitivity bypass in email blacklistGemini 3.7 Flash missed it · MiniMax M3 missed it
CriticalThe logic for checking team admin/owner permissions is incorrect. This condition uses AND (&&) which requires both isTeamAdmin AND isTeamOwner to be true, but it should use OR (||) since a user needs to be either an admin OR an owner to have permission.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumThis calls the email sender with the original guests, so existing attendees included in the input will be treated as new when sending notifications, leading to incorrect emails.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumuniqueGuests filters out existing attendees and blacklisted emails but does not deduplicate duplicates within the input; createMany can insert duplicate attendee rows if the client submits repeated emails.Gemini 3.7 Flash found it · MiniMax M3 found it
LowStarting with an array containing an empty string may cause validation issues. Consider starting with an empty array [] and handling the empty state in the MultiEmail component instead.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Keycloak · Javaadd-html-sanitizer-for-translated-message-resources-keycloakagree · 4 goldens
MediumThe translation is in Italian instead of Lithuanian. This should be translated to Lithuanian to match the file's locale (messages_lt.properties).Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumThe totpStep1 value uses Traditional Chinese terms in the Simplified Chinese file (zh_CN), which is likely incorrect for this locale. Please verify the locale‑appropriate translation.Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowThe anchor sanitization logic has a potential issue where it consumes English matcher groups without proper validation. If the translated text has more anchor tags than the English text, this could lead to incorrect validation results.Gemini 3.7 Flash found it · MiniMax M3 found it
LowThe method name 'santizeAnchors' should be 'sanitizeAnchors' (missing 'i').Gemini 3.7 Flash missed it · MiniMax M3 missed it
Grafana · Goanonymous-add-configurable-device-limit-grafana-codex1 disagree · 5 goldens
HighRace condition: Multiple concurrent requests could pass the device count check simultaneously and create devices beyond the limit. Consider using a database transaction or lock.Gemini 3.7 Flash missed it · MiniMax M3 found it
MediumAnonymous authentication now fails entirely if anonDeviceService.TagDevice returns ErrDeviceLimitReached. Previously, device tagging was asynchronous and non-blocking. This change prevents anonymous users from authenticating when the device limit is reached.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumThis call won’t compile: dbSession.Exec(args...) is given a []interface{} where the first element is the query, but Exec’s signature requires a first parameter of type string (not an interface{} splat).Gemini 3.7 Flash found it · MiniMax M3 found it
LowReturning ErrDeviceLimitReached when no rows were updated is misleading; the device might not exist.Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowTime window calculation inconsistency: Using device.UpdatedAt.UTC().Add(-anonymousDeviceExpiration) as the lower bound but device.UpdatedAt as the current time may not match the intended logic. Consider using time.Now().UTC() consistently.Gemini 3.7 Flash found it · MiniMax M3 found it
Grafana · Godual-storage-architecture-grafana-codexagree · 3 goldens
MediumThe context is being created with d.Log instead of the log variable that was initialized with additional context values (name, kind, method). This means those values won't be propagated to the logging context.Gemini 3.7 Flash found it · MiniMax M3 found it
HighBug: calling recordLegacyDuration when storage operation fails should be recordStorageDuration.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumInconsistency: using name instead of options.Kind for metrics recording differs from other methods.Gemini 3.7 Flash found it · MiniMax M3 found it
Discourse · Rubyenhance-embed-url-handling-and-validation-system-discourse-cursoragree · 6 goldens
CriticalSSRF vulnerability using open(url) without validationGemini 3.7 Flash missed it · MiniMax M3 missed it
MediumThe current origin validation using indexOf is insufficient and can be bypassed. An attacker could use a malicious domain like evil-discourseUrl.com to pass this check.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumpostMessage targetOrigin should be the origin (scheme+host+port), not the full referrer URL; using the full URL will cause the message to be dropped and prevent resizing.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumThe code sets X-Frame-Options: ALLOWALL which completely disables clickjacking protection. The referer validation can be bypassed (referer headers are easily spoofed), and the fallback to empty string for nil referer masks validation failures.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumThe TopicEmbed.import method is susceptible to a NoMethodError if the contents parameter is nil when attempting to append a string, and an XSS vulnerability due to unescaped url interpolation in the generated HTML.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumThe ERB block closes with end if, which is invalid Ruby/ERB and will raise at render; it should just be end to close the if block.Gemini 3.7 Flash missed it · MiniMax M3 missed it
cal.com · TypeScriptfeat-2fa-backup-codes-cal-comagree · 4 goldens
LowThe exported function TwoFactor handles backup codes and is in BackupCode.tsx. Inconsistent naming.Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowError message mentions 'backup code login' but this is a disable endpoint, not loginGemini 3.7 Flash missed it · MiniMax M3 missed it
MediumBackup code validation is case-sensitive due to the use of indexOf(). This causes validation to fail if a user enters uppercase hex characters, as backup codes should be case-insensitive for a better user experience.Gemini 3.7 Flash found it · MiniMax M3 found it
HighBecause backupCodes are decrypted and mutated in memory before being written back, two concurrent login requests using the same backupCode could both pass this check and update, so a single backup code may effectively be accepted more than once if used concurrently, weakening the intended one-time-use semantics.Gemini 3.7 Flash found it · MiniMax M3 found it
cal.com · TypeScriptfeat-convert-insightsbookingservice-to-use-prisma-sql-raw-queries-cal-comagree · 2 goldens
LowIn getBaseConditions(), the else if (filterConditions) and final else branches are unreachable. This is because getAuthorizationConditions() always returns a non-null Prisma.Sql object, making authConditions always truthy, which means only the first two if/else if conditions are ever evaluated.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumFetching userIdsFromOrg only when teamsFromOrg.length > 0 can exclude org-level members for orgs without child teams; consider deriving from teamIds (which includes orgId) or removing the guard so org-only orgs still include member user bookings.Gemini 3.7 Flash found it · MiniMax M3 found it
Sentry · Pythonfeat-ecosystem-implement-cross-system-issue-synchronization-sentryagree · 4 goldens
MediumShared mutable default in dataclass timestampGemini 3.7 Flash found it · MiniMax M3 found it
LowThe method name has a typo: test_from_dict_inalid_data should be test_from_dict_invalid_data.Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowMethod name says 'empty_array' but tests empty dict - consider renaming to 'test_from_dict_empty_dict' for clarity.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Mediumto_dict() returns a datetime for queued; if this dict is passed in task kwargs (e.g., via apply_async), JSON serialization may fail depending on the serializer, which can cause enqueue errors.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Sentry · Pythonfeat-workflow-engine-add-in-hook-for-producing-occurrences-from-the-stateful-det-sentryagree · 2 goldens
HighMetricAlertDetectorHandler inherits from StatefulDetectorHandler but only contains pass, failing to implement its required abstract methods: counter_names (property), get_dedupe_value(), get_group_key_values(), and build_occurrence_and_event_data(). This will cause a TypeError at runtime when the class is instantiated.Gemini 3.7 Flash found it · MiniMax M3 found it
LowDocstring says this returns a list of DetectorEvaluationResult, but the method now returns a dict keyed by DetectorGroupKey. Consider updating the docstring to match the new return type.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Discourse · Rubyfeature-automatically-downsize-large-images-discourse-cursoragree · 3 goldens
MediumThe downsize method is defined twice. The second definition, which expects a single dimensions string parameter, overrides the first, which expected separate max_width and max_height parameters. This makes the original method unreachable and breaks existing code that calls it with separate width and height arguments.Gemini 3.7 Flash found it · MiniMax M3 found it
LowHardcoding maxSizeKB = 10 * 1024 ignores Discourse.SiteSettings['max_' + type + '_size_kb'], so the client-side limit can diverge from server-side and per-type settings (also applies to the 413 handler below).Gemini 3.7 Flash found it · MiniMax M3 found it
MediumPassing 80% as the dimensions can fail for animated GIFs when allow_animated_thumbnails is true, since the animated path uses gifsicle --resize-fit which expects WxH geometry, not a percentage; downsizing would then silently fail.Gemini 3.7 Flash found it · MiniMax M3 found it
Discourse · Rubyfeature-can-edit-category-host-relationships-for-embedding-discourse-cursoragree · 4 goldens
CriticalNoMethodError before_validation in EmbeddableHostGemini 3.7 Flash found it · MiniMax M3 found it
MediumThe update and destroy methods in Admin::EmbeddableHostsController do not validate the existence of the EmbeddableHost record retrieved by ID. If EmbeddableHost.where(id: params[:id]).first returns nil (i.e., the host does not exist), attempting to call methods on the nil object (e.g., save_host or destroy) will result in a NoMethodError.Gemini 3.7 Flash found it · MiniMax M3 found it
Mediumrecord_for_host compares lower(host) = ? but does not normalize the parameter’s case, so mixed‑case referer hosts may fail to match even though comparison intends to be case‑insensitive.Gemini 3.7 Flash missed it · MiniMax M3 missed it
HighBecause this migration inserts embeddable_hosts rows with raw SQL, any existing embeddable_hosts values that include http:// or /https:// or path segments won’t go through the EmbeddableHost model’s normalization, so the new host lookup (which compares only the bare host) may fail for migrated data. Consider ensuring that migrated hosts are normalized to the same format as newly created EmbeddableHost records so existing embedding configurations keep working.Gemini 3.7 Flash found it · MiniMax M3 found it
Discourse · Rubyfeature-localization-fallbacks-server-side-discourse-cursoragree · 2 goldens
LowThread-safety issue with lazy @loaded_localesGemini 3.7 Flash missed it · MiniMax M3 missed it
LowConsider normalizing the input locale (e.g., to a symbol) when checking/loading here to avoid double-loading if the same locale is passed as a String vs Symbol (also applies to other locations in the PR).Gemini 3.7 Flash found it · MiniMax M3 found it
Keycloak · Javafix-concurrent-group-access-to-prevent-nullpointerexception-keycloakagree · 2 goldens
CriticalReturning null from getSubGroupsCount() violates the GroupModel contract (Javadoc says it never returns null) and may lead to NPEs in callers that expect a non-null count.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumThe reader thread isn’t waited for; flipping deletedAll to true and asserting immediately can race and miss exceptions added just after the flag change, making this test flaky.Gemini 3.7 Flash missed it · MiniMax M3 missed it
cal.com · TypeScriptfix-handle-collective-multiple-host-on-destinationcalendar-cal-comagree · 5 goldens
HighPotential null reference if mainHostDestinationCalendar is undefined if evt.destinationCalendar is null or an empty array Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowThe optional chaining on mainHostDestinationCalendar?.integration is redundant since you already check mainHostDestinationCalendar in the ternary condition.Gemini 3.7 Flash missed it · MiniMax M3 missed it
HighLogic error: when externalCalendarId is provided, you're searching for a calendar where externalId === externalCalendarId, but this will always fail since you're looking for a calendar that matches itself. Should likely find by credentialId or use different logic.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumLogic inversion in organization creation: The slug property is now conditionally set when IS_TEAM_BILLING_ENABLED is true, instead of when it's false as originally intended. This change, combined with requestedSlug still being set when IS_TEAM_BILLING_ENABLED is true, results in both properties being set when billing is enabled, and neither when disabledGemini 3.7 Flash found it · MiniMax M3 found it
LowThe Calendar interface now requires createEvent(event, credentialId), but some implementations (e.g., Lark/Office365) still declare createEvent(event) only—this breaks the interface contract (also applies to other locations in the PR).Gemini 3.7 Flash found it · MiniMax M3 found it
Discourse · Rubyfix-proper-handling-of-group-memberships-discourse-cursoragree · 3 goldens
High The findMembers() call is now asynchronous and unhandled. The controller may not have member data immediately available, creating a race condition.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumIn the next action, capping the next offset at user_count can produce an empty page (e.g., total equal to limit results in offset == total, showing 2/2 with no members). This can cause confusing UX on the last page.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumHTTP method mismatch in .remove_member - test uses PUT but remove_member action expects DELETEGemini 3.7 Flash missed it · MiniMax M3 missed it
Keycloak · Javafixing-re-authentication-with-passkeys-keycloakagree · 2 goldens
MediumConditionalPasskeysEnabled() called without UserModel parameterGemini 3.7 Flash missed it · MiniMax M3 missed it
MediumWith isConditionalPasskeysEnabled(UserModel user) requiring user != null, authenticate(...) will not call webauthnAuth.fillContextForm(context) on the initial login page where context.getUser() is still null, so conditional passkey UI will not be set up for first-time passkey login. Consider whether this should also be enabled when no user has been selected yet so ID-less passkey authentication on the initial login form continues to work.Gemini 3.7 Flash found it · MiniMax M3 found it
Grafana · Gofrontend-asset-optimization-grafana-codexagree · 2 goldens
MediumThe GetWebAssets function implements an incomplete double-checked locking pattern for caching web assets. The function first checks if the cache is populated using a read lock (RLock), and if the cache is empty, it acquires a write lock to populate it. However, it fails to re-check whether the cache was populated by another goroutine while waiting to acquire the write lock.Gemini 3.7 Flash found it · MiniMax M3 found it
HighIn addition to the missing double-check, the function has a critical flaw in its error handling: it unconditionally assigns the fetch result to the cache (line 69: entryPointAssetsCache = result) regardless of whether the fetch succeeded or failed. When an error occurs during asset fetching, result is nil, and this nil value overwrites any previously valid cache entry.Gemini 3.7 Flash found it · MiniMax M3 found it
Sentry · Pythongithub-oauth-security-enhancement-sentryagree · 3 goldens
MediumNull reference if github_authenticated_user state is missingGemini 3.7 Flash missed it · MiniMax M3 missed it
MediumOAuth state uses pipeline.signature (static) instead of a per-request random valueGemini 3.7 Flash missed it · MiniMax M3 missed it
HighThe code attempts to access integration.metadata[sender][login] without checking for the existence of the sender key. This causes a KeyError for integrations where the sender metadata was not set during creationGemini 3.7 Flash found it · MiniMax M3 found it
Keycloak · Javaimplement-access-token-context-encoding-framework-keycloakagree · 4 goldens
CriticalWrong parameter in null check (grantType vs. rawTokenId)Gemini 3.7 Flash found it · MiniMax M3 found it
HighIn isAccessTokenId, the substring for the grant shortcut and the equality check look inverted: the grant shortcut occupies indices 4–5 (substring(4,6)), and a match should return true (combined with UUID check), not false.Gemini 3.7 Flash found it · MiniMax M3 found it
LowJavadoc mentions "usually like 3-letters shortcut" but some implementations use 2-letter shortcuts ("ac", "cc", "rt", "te", "pc", "ci", "ro"). Consider updating documentation to reflect actual usage pattern.Gemini 3.7 Flash found it · MiniMax M3 found it
Low Catching generic RuntimeException is too broad. The implementation throws IllegalArgumentException specifically - catch that instead for more precise testing.Gemini 3.7 Flash missed it · MiniMax M3 missed it
Grafana · Gonotification-rule-processing-engine-grafana-codexagree · 2 goldens
MediumThe rendered GrafanaRuleListItem is missing the required key prop for React list items. This can cause rendering issues when the list order changes.Gemini 3.7 Flash missed it · MiniMax M3 missed it
HighRuleActionsButtons is invoked with only promRule, but SilenceGrafanaRuleDrawer inside RuleActionsButtons still depends on a Grafana Ruler rule being present, so for Grafana rules coming from list views the 'Silence notifications' menu entry (now driven by Grafana Prom abilities) will toggle showSilenceDrawer without ever rendering the drawer. This means clicking 'Silence notifications' for these rules has no visible effect, even when abilities indicate silencing is allowed.Gemini 3.7 Flash found it · MiniMax M3 found it
cal.com · TypeScriptoauth-credential-sync-and-app-integration-enhancements-cal-comagree · 5 goldens
HighThe parseRefreshTokenResponse function incorrectly sets refresh_token to the hardcoded string 'refresh_token' when it's missing from the OAuth refresh token response. This invalidates the token, breaking subsequent token refreshes and causing authentication failures.Gemini 3.7 Flash found it · MiniMax M3 found it
HighInvalid Zod schema syntax. Computed property keys like [z.string().toString()] are not valid in Zod object schemas and will cause runtime errors. Gemini 3.7 Flash missed it · MiniMax M3 missed it
HighparseRefreshTokenResponse returns a Zod safeParse result ({ success, data, error }), not the credential key object. Persisting that as key stores the wrapper instead of the token payload; we should store the parsed data or use schema parse.Gemini 3.7 Flash found it · MiniMax M3 found it
HighWhen APP_CREDENTIAL_SHARING_ENABLED and CALCOM_CREDENTIAL_SYNC_ENDPOINT are set, the refreshFunction helper returns the fetch Response, but several callers (for example GoogleCalendarService.refreshAccessToken expecting res.data, and HubspotCalendarService.refreshAccessToken expecting a HubspotToken) assume it returns the integration-specific token object. That mismatch will cause runtime errors in the sync-enabled path unless the return type or those call sites are adjusted.Gemini 3.7 Flash found it · MiniMax M3 found it
HighWhen the sync endpoint path is used, res is a fetch Response and has no .data; res?.data will be undefined and token.access_token will throw at runtime. This relies on a consistent return shape from refreshOAuthTokens, which isn’t guaranteed currently.Gemini 3.7 Flash found it · MiniMax M3 found it
Discourse · Rubyoptimize-header-layout-performance-with-flexbox-mixins-discourse-cursor1 disagree · 2 goldens
LowMixing float: left with flexbox causes layout issues. Further this PR removes the float-based right alignment for .d-header .panel, which may cause the login panel in the non-Ember/noscript header (where .panel is nested inside .row and not a flex item) to stack under the title instead of remaining right-aligned.Gemini 3.7 Flash found it · MiniMax M3 found it
Low-ms-align-items never existed in any version of IE/Edge; the correct legacy property is -ms-flex-align.Gemini 3.7 Flash missed it · MiniMax M3 found it
Grafana · Goplugins-chore-renamed-instrumentation-middleware-to-metrics-middleware-grafana-codexagree · 2 goldens
HighThe ContextualLoggerMiddleware methods (QueryData, CallResource, CheckHealth, CollectMetrics) panic when a nil request is received. This occurs because they directly access req.PluginContext (via the instrumentContext function) without first checking if req is nil. This is a regression, as previous middleware layers gracefully handled nil requests.Gemini 3.7 Flash found it · MiniMax M3 found it
LowThe traceID is no longer logged for plugin requests. During a refactoring, the tracing import and the logic to extract and add traceID from the context to log parameters were removed from the LoggerMiddleware. The newly introduced ContextualLoggerMiddleware does not add this information, resulting in missing traceID in plugin request logs and impacting debugging and request tracing capabilities.Gemini 3.7 Flash found it · MiniMax M3 found it
Sentry · Pythonreplays-self-serve-bulk-delete-system-sentryagree · 3 goldens
MediumBreaking changes in error response formatGemini 3.7 Flash missed it · MiniMax M3 missed it
MediumDetector validator uses wrong key when updating typeGemini 3.7 Flash missed it · MiniMax M3 missed it
LowUsing zip(error_ids, events.values()) assumes the get_multi result preserves the input order; dict value order is not guaranteed to match error_ids, so event data can be paired with the wrong ID (missing nodes also shift alignment).Gemini 3.7 Flash found it · MiniMax M3 found it
Sentry · Pythonref-crons-reorganize-incident-creation-issue-occurrence-logic-sentryagree · 2 goldens
HighThe function modifies the config variable to include display values but then returns the original monitor.config instead of the modified version.Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowThe code fetches MonitorCheckIn objects by ID when the required data already exists in previous_checkins. This creates an unnecessary database query.Gemini 3.7 Flash missed it · MiniMax M3 missed it
cal.com · TypeScriptsms-workflow-reminder-retry-count-tracking-cal-comagree · 2 goldens
HighUsing retryCount: reminder.retryCount + 1 reads a possibly stale value and can lose increments under concurrency; consider an atomic increment via Prisma (increment: 1) to avoid race conditions (also applies to the similar update in the catch block).Gemini 3.7 Flash found it · MiniMax M3 found it
HighThe deletion logic in scheduleSMSReminders.ts incorrectly deletes non-SMS workflow reminders (e.g., Email, WhatsApp) that have retryCount > 1. This occurs because the retryCount condition within the OR clause for deletion lacks a method: WorkflowMethods.SMS filter, causing it to apply to all reminder types instead of only SMS reminders, which is the intended scope of this function.Gemini 3.7 Flash found it · MiniMax M3 found it
Sentry · Pythonspan-buffer-multiprocess-enhancement-with-health-monitoring-sentryagree · 5 goldens
MediumInconsistent metric tagging with 'shard' and 'shards'Gemini 3.7 Flash missed it · MiniMax M3 missed it
LowFixed sleep in tests can be flaky; wait on condition insteadGemini 3.7 Flash missed it · MiniMax M3 missed it
HighBecause flusher processes are created via multiprocessing.get_context('spawn').Process, they are instances of multiprocessing.context.SpawnProcess, which on POSIX is not a subclass of multiprocessing.Process, so this isinstance check will always be false and hung processes won't be killed here.Gemini 3.7 Flash found it · MiniMax M3 found it
MediumSleep in test_consumer.py won’t actually wait because time.sleep was monkeypatched above; consider restoring sleep or using a different sync to ensure the flusher has time to process.Gemini 3.7 Flash missed it · MiniMax M3 missed it
MediumBreaking out of the loop when the deadline has elapsed can skip terminating remaining flusher processes, potentially leaving them running after shutdown; consider ensuring termination is attempted even if the deadline is exceeded.Gemini 3.7 Flash found it · MiniMax M3 found it
Grafana · Gounified-storage-performance-optimizations-grafana-codexagree · 2 goldens
HighA race condition in BuildIndex allows multiple goroutines to concurrently build the same expensive index for the same key. This is caused by moving the b.cacheMu lock from protecting the entire function to only protecting the final cache assignment. Gemini 3.7 Flash found it · MiniMax M3 found it
HighCalling s.search.TotalDocs() here may race with concurrent index creation: TotalDocs iterates b.cache without synchronization, and the event watcher goroutine started just above could trigger BuildIndex writes concurrently, potentially causing a concurrent map read/write panic.Gemini 3.7 Flash found it · MiniMax M3 found it