Goodcatch · Hone your code reviews

Goodcatch.dev

Start free

Writing code got easier. Reviewing it didn’t.

YO You requested changes

Practice on real PRs and build the judgment that teams and interview loops actually grade you on.

Start a review Try a sample review ›

Real PRs in 40+ languages & frameworks.
First 3 reviews free, no card.

Why now

32.7%

of AI-generated PRs get merged. For human-written PRs it’s 84.4%.

Source: LinearB 2026 Benchmarks, 8.1M PRs

The bottleneck moved from writing code to reviewing it.

AI writes code faster than any team can read it. The scarce skill is no longer writing the solution. It’s the judgment to catch what the model gets subtly, dangerously wrong, and it’s what staff-level loops increasingly probe for.

How it works

Read it. Flag it. Get the verdict.

Every session is a real PR. You review it like you would at work, then get graded on what mattered.

← Dashboard Simplify token parsing in auth middleware #482 TypeScript · Senior

src/middleware/auth.ts hover a line, then click the +

@@ -12,7 +12,8 @@ export async function auth(req)

12 12 export async function auth(req, res, next) {

13 13 const token = bearer(req)

14 − const payload = jwt.verify(token, SECRET)

14 + const payload = decode(token)

15 + if (payload.role == 'admin') req.isAdmin = true

15 16 req.user = await db.users.find(payload.sub)

16 17 return next()

17 18 }

18 19

19 20 export function bearer(req) {

20 21 return req.headers.authorization?.slice(7)

21 22 }

Your review

No line comments yet · add a summary and a decision 1 line comment · add a summary and a decision

Summary

Decision

Submit review

Result

Senior-level review

You caught the forged-token bug, said why it matters and how to fix it, and blocked the merge. The admin role check on line 15 slipped past you.

Issues 56 / 80 Decision 20 / 20 Noise 0

✓ CAUGHT Signature check dropped 56 / 56

✓ Located · 60%✓ Impact · 20%✓ Fix · 15%✓ Labeled · 5%

✕ MISSED Admin role from an unverified token 0 / 24

Senior reviewer: payload.role comes from a token nobody verified, so anyone can make themselves admin. Read the role from the verified claims.

Field guide

What slips through review.

Challenges hide defects like these inside full PRs. You learn to spot them by pattern, not by luck.

SQL injection

blocking

db.query(`… WHERE id = ${id}`)

User input glued into SQL. One request and the table is theirs.

Missing await

blocking

const ok = checkQuota(user)

if (ok) upload(file)

A Promise is always truthy, so the quota never says no.

Unverified JWT

blocking

const p = jwt.decode(token)

if (p.role === 'admin') next()

Decoded is not verified. Anyone can mint themselves admin.

Race condition

major

const bal = await getBalance(id)

await setBalance(id, bal - amt)

Two requests read the same balance. Double spend.

N+1 query

major

for (const o of orders)

o.user = await db.users.find(o.userId)

One query per row. Fine in dev, on fire in prod.

Off-by-one

minor

for (let i = 0; i <= items.length; i++)

Reads one past the end and hands undefined downstream.

Your profile

Know your blind spots.

The engine learns where you slip, like missed concurrency bugs, security holes, or approving changes you should have blocked, so you know exactly what to practice next.

Your weak spots last 30 reviews

Auth & security holes high

Missed 4 of 6 recently.

Approving risky changes high

Approved 2 PRs that needed changes.

Trusting unvalidated input medium

Missed 3 of 7 recently.

Tracks

Practice with your stack.

Guided tracks of real reviews in popular stacks. Finish every challenge in a track and earn the badge.

Browse all tracks ›

TypeScript Python React Vue Svelte Java Next.js Laravel Django Rails

Pricing

Practice until the catch is automatic.

Your first 3 challenges are free, no card required.

Monthly

$19 /mo

Unlimited reviews, every difficulty tier, and practice aimed at your weak spots.

Get started

3-Month Sprint For interviewing

$45 one-time

No auto-renew. Full access for an active interview season.

Start the sprint

Yearly Save 37%

$144 /yr

About $12/mo, auto-renews. Everything in Monthly for less.

Get started

Cancel anytime

FAQ

Questions, answered.

See all FAQs ›

Goodcatch is a code-review practice app. You review real pull requests, then get graded on what you caught, what you missed, and where you spent review you didn't need to. It's the same judgment senior and staff loops test.

Find it before it ships.

Hone your code reviews on real PRs. First 3 challenges free, no card required.

Start a review

Hone your code reviews.

The bottleneck moved from writing code to reviewing it.

Read it. Flag it. Get the verdict.

What slips through review.

SQL injection

Missing await

Unverified JWT

Race condition

N+1 query

Off-by-one

Know your blind spots.

Practice with your stack.

Practice until the catch is automatic.

Questions, answered.

Find it before it ships.