How does SuperClue check source code?
SuperClue has two separate code engines. Basic SAST is a fast pattern scan with 10 rule groups, built for CI/CD pipelines. AI code review reads files from a connected repository or pull request and explains each finding with a suggested fix.
Which engine should I use?
| Basic SAST | AI code review | |
|---|---|---|
| How it works | 10 regex rule groups, language-agnostic | AI reads your source files and returns findings tagged with CWE and OWASP |
| Input | Code sent through a scan or the CI/CD API | A connected repository or a pull request |
| Scope | The code you submit | Up to 80 files per run, 300 KB per file |
| Cost | 9.52 credits per scan | 25 credits per repository, 10 per pull request |
What does basic SAST look for?
It matches 10 rule groups: SQL injection, cross-site scripting, hard-coded credentials, command injection, code injection, path traversal, CSRF, insecure headers, insecure deserialisation and weak cryptography.
The rules are regular expressions and do not depend on the language, so they work on any text file. They catch common patterns quickly but do not understand data flow. This is the engine behind the CI/CD scan in integrations.
What does AI code review do?
- Connects to GitHub, GitLab (gitlab.com), Bitbucket or Azure DevOps with a personal access token. The token is encrypted at rest.
- Reviews up to 80 files of up to 300 KB each per run, across 31 languages and config formats, including Python, JavaScript, TypeScript, Java, Go, C#, PHP, Rust, Kotlin, Terraform and Dockerfiles.
- Reviews pull requests and posts findings as review comments.
- Runs repository reviews on a schedule, and can review new pull requests automatically.
- Adds git blame details (author, commit, date) to each finding.
- Exports findings as SARIF for tools that read it.
- Lets you add your own regex rules next to the AI review.
What happens to my code?
AI code review sends the selected files to a third-party AI service for analysis. We do not store your repository. We store the findings, and each finding keeps a short snippet of the affected code so you can see the problem in context. If that is not acceptable for a repository, use basic SAST instead, which runs on our own servers.
The data processing page lists the services that handle customer data.
What does it cost?
Basic SAST costs 9.52 credits per scan. AI code review costs 25 credits per repository scan and 10 credits per pull request. See pricing for credit packs.
Connect a repository and run a review.
Request access