git-lrc Commit-Time Code Review

SECURITY.md specifically identifies destinations, triggers, and local storage for diff submissions, authentication payloads, telemetry, and updates. It also describes selected-diff scoping, cross-host redirect restrictions, restricted and atomic credential writes, security scanning, and SBOM production. Installation, global hooks, commits, pushes, bypasses, disabling, and uninstallation are documented, while static tests support uninstall and recovery behavior; this justifies strong data-flow, external-effect, and rollback scores. Deductions apply because machine-wide hooks and remote review have broad impact, and an automatically triggered commit hook does not obtain fresh confirmation on every invocation. Key protection and server-side sanitization are supported mainly by documentation and some references to a separate LiveReview tree, while retention and model-training policy depend on the selected deployment. The license identifies Hexmos Technology LLP and contact channels, but registry provenance is unverified and the supplied material does not provide comprehensive attribution for all incorporated components.

The README, workflows, and hook tests broadly agree on automatic review, attestation reuse, worktree isolation, disable markers, installation, and uninstallation, and the tests assert several user-facing failure messages. Deductions apply because the evidence does not cover all runtime failure paths and operation depends on external LiveReview, model-provider, installer, and Claude CLI availability. The README also places a “completely free” claim beside LOC-based premium pricing, while “Skip” is described both as bypassing review and as aborting a commit, weakening self-consistency.

The material addresses individual engineers, teams, and engineering leaders and covers manual review, commit-triggered review, Claude Code, CI, worktrees, self-hosting, and multiple AI connectors. Boundaries are unusually explicit: staged diffs are the default scope, AI output is advisory, risk scoring is optional and review continues without it, and the unenforced policy directory is labeled TODO. Commands, vouch and skip modes, disable controls, ignore rules, and the 3000-character rules limit are precise, with installation coverage for Linux, macOS, Windows, and Codespaces. No further deduction is warranted within static documentation; these scores do not assert that runtime compatibility was independently tested.

The README has substantial structure covering installation, setup, workflows, UI, risk scoring, connectors, repository rules, pricing, and security. Examples are extensive, SECURITY.md states known limitations, and LICENSE.md explains permitted and prohibited uses in detail, supporting high scores for those criteria. Deductions apply because git-lrc, lrc, and LiveReview are used interchangeably enough to blur the product boundary, and no version history or changelog is supplied. The license text is clear, although the provided repository metadata says NOASSERTION, so downstream license detection still needs confirmation. A company, founder email, vulnerability channel, and response commitments are named, but publisher identity is not enterprise-registry verified and ordinary release-maintenance ownership is less fully specified than security response ownership.

The Issue Navigator, inline comments, severity and category filters, issue copying, summary deck, risk ordering, and git-log attestations are all designed to make findings actionable and transferable, supporting a strong output-usability score. Commit-time triggering, scoped diff review, and optional local graph analysis offer plausible incremental value over an unassisted git workflow. Deductions apply because claims about preventing outages, breaches, and technical debt, tracking more than 100 patterns, and improving efficiency are chiefly product assertions and screenshots rather than comparative evaluation evidence. Pricing is described, but total cost also includes user-provided model keys, remote services, initial indexing time, and data-governance overhead, so the cost-benefit case is not fully established by static sources.

Many security claims point to named modules, tests, workflows, and storage or network inventories; hook lifecycle behavior is also corroborated between CI definitions and test scripts. The documentation distinguishes scanner coverage from what scanners cannot guarantee and explicitly labels the future policy feature as unenforced. Deductions apply because several important references are in files not supplied here or in a separate LiveReview repository, preventing verification from the available evidence. Badges, workflow definitions, and test source establish configuration and intent, not successful execution at this revision. Marketing outcomes, risk-ranking quality, 60-second setup, and performance figures are not consistently separated from verified facts or clearly labeled inference.