Orange Codens auto-reviews your GitHub Pull Requests with AI. It detects bugs, vulnerabilities, and design risks and comments findings, then hands them off to Purple / Red Codens to create the fix PR automatically.
Orange Codens is currently in Closed Beta. You can install it yourself via the GitHub App, self-serve. For enterprise rollout support or custom integrations, please contact us.
Orange Codens is an AI code review and security audit tool that automatically reviews GitHub Pull Requests, detects bugs and vulnerabilities before they ship, and generates fix PRs. It also audits dependency libraries for known vulnerabilities via SCA/SBOM, and hands findings off to Purple Codens and Red Codens to auto-generate fix PRs. It is part of the Codens suite.
Since launch in June 2026, Orange has reviewed 21,176 PRs across 3 organizations and 72 repositories (as of October 27, 2026), raising 45,963 findings, 9,145 of them security findings and 1,705 rated critical or high. Median review time over the last 30 days is 2.9 minutes. Real security findings include cross-tenant reads, SSRF, SQL injection, an unauthenticated Lambda Function URL, a sandbox escape, and token exfiltration via prompt injection.
From the moment a PR opens, the pre-merge quality gate runs automatically.
A developer or Purple opens a PR
AI analyzes the diff for bugs & vulns
Severity-rated findings posted on the PR
Findings go to Purple / Red for a fix PR
Re-evaluates the fix; APPROVE when resolved
The Orange → Purple/Red fix loop takes about 8 minutes per cycle (handoff → fix PR → APPROVE → auto-merge).
Handoff is a suggestion gate before merge; auto-ticketing happens at PR merge — Bot-authored PRs are excluded by loop guards.
Guarantee review quality and security without slowing engineers down.
Analyzes the PR diff in context to detect bugs, race conditions, null dereferences, resource leaks, and design risks — with concrete, actionable findings.
Matches your dependencies and Node.js / Python runtime versions against the OSV vulnerability database, runs trufflehog secret scanning and Trivy / checkov IaC configuration scanning. Exports SBOMs as CycloneDX / SPDX and re-checks stored SBOMs against new CVEs periodically. Running on our own 13 repositories (as of October 27, 2026).
Critical findings act as a pre-merge gate. Add an AI check to your merge conditions alongside CI/CD and human review.
Pass findings straight to Purple Codens / Red Codens to auto-generate fix PRs — closing the loop from review to fix. 676 findings have been handed off so far and 275 were fixed via merged PRs (measured 2026-10-27).
Handoff is being enabled progressively during the Closed Beta. Check your review comments, or contact us to confirm availability for your organization.
Language- and framework-agnostic review criteria, so monorepos and multi-stack repositories are fully supported.
Comments on PRs as a GitHub App — it drops straight into your existing workflow.
Slack notifications are currently set up individually for organizations that contact us (not yet self-serve).
Codens is an AI development suite from Japan that automates the entire software development lifecycle — requirements (Green), implementation (Purple), code review & security audit (Orange), QA/E2E testing (Blue), and production error auto-fix (Red). Teams can build and operate software products without a large team of specialist engineers. Orange is the checkpoint before merge.
All products share Auth Codens (unified auth) for login and a shared credit pool.
An honest comparison for teams evaluating AI code review and security audit tools — including where competitors are strong.
| Dimension | Orange Codens | CodeRabbit | SonarQube | Snyk Code |
|---|---|---|---|---|
| Detection approach | LLM (Claude) context-aware diff review | LLM + 40+ linters combined for low noise | Rule-based static analysis (SAST) | Symbolic analysis + generative AI hybrid |
| Response to findings | Handed off to Purple/Red Codens to auto-generate a fix PR | Mostly inline comments (Autofix is limited Early Access) | Findings only; fixes are manual | Offers Autofix (80% claimed accuracy); security-only |
| PRD × implementation gap detection | Cross-checks the PR diff against the PRD in Green Codens | Not supported | Not supported | Not supported |
| Security audit scope | SCA/SBOM + secret detection integrated with code quality | Code-quality focused; security is limited | Code-quality focused; security needs a separate plugin | Broad SCA/SAST/IaC coverage as a security specialist |
| Japanese / currency support | Japanese PR comments, JPY credit billing, JST support | English-first | English-first | Has a Japan office, but pricing/support are US-led |
| Pricing structure* | Credit-based (1 credit = JPY 0.01), no review-count cap. Measured median ≈79 credits (~JPY 0.8) per review | Pro $24/dev/month (annual). 5 reviews/hr/developer cap + Fair Usage + $0.25/file add-on | Free OSS edition + commercial Developer/Enterprise tiers | From $25 / dev / month; Enterprise runs millions of yen/year |
| Adoption | Closed Beta (mainly existing Codens Suite organizations) | 2M+ repos, dominant share in AI PR review | Long-established static analysis tool with broad language support | 10+ years in market; top-of-mind for Enterprise audit requirements |
Strong adoption in English-speaking markets, with a well-regarded low-noise review built on 40+ combined linters. Pricing is per-seat with a review-rate cap, a Fair Usage policy, and a usage-based add-on for overage (source). Orange is a good fit when you need Japanese support, uncapped review volume, or PRD integration.
A proven rule-based static analysis tool, but it has no built-in way to turn findings into fix PRs.
A security specialist offering high-precision vulnerability detection and Autofix. If you also want unified code-quality review, pairing it with Orange is worth considering.
* CodeRabbit pricing and specs reflect publicly available information as of July 2026 (sources: Plans / Usage-based Add-on / Pricing). Orange Codens figures are a measured median from our own billing ledger (n=1,273 billed reviews, 2026-07-08 to 2026-07-27). Please check each vendor's official site and your own contract for the latest, actual figures. Orange Codens is currently in Closed Beta.
Pay only for what you use, with no review-count cap, using the Codens Suite's shared credits (1 credit = JPY 0.01).
Measurement basis: 2026-07 billing ledger, our own usage (n=1,273 billed reviews, 2026-07-08 to 2026-07-27). Varies with PR size. The flip side of having no review-count cap: a small share of very large PRs cost substantially more (p99 ≈JPY 46, measured max ≈JPY 152). See the pricing simulator for details.
Credits are shared across all products in your plan, including Red, Blue, Green, and Orange.
Just connect Orange Codens to GitHub. Experience everything from the first review to the fix PR.
Currently in Closed Beta. You can install it yourself via the GitHub App, self-serve. For enterprise rollout support, please contact us.
Common questions we hear before adopting Orange Codens.
Orange Codens is a code review and security audit service that uses AI to automatically review GitHub Pull Requests. It analyzes the diff to detect bugs, vulnerabilities, and design risks, and also audits dependency libraries with SCA/SBOM. Findings are handed off to Purple/Red Codens to generate fix PRs automatically, so it acts as a quality gate before merge.
Once connected as a GitHub App, Orange analyzes the diff in context the moment a PR is opened or updated. It detects bugs, race conditions, null dereferences, resource leaks, and design risks, then comments severity-rated findings on the PR. Critical findings can act as a merge gate, adding an AI check on top of CI/CD and human review.
Orange extracts an SBOM of your dependencies (npm / PyPI / Go) plus the Node.js / Python runtime versions and matches it against the OSV vulnerability database to find known vulnerabilities. It also runs trufflehog secret scanning for leaked credentials and Trivy / checkov configuration scanning for IaC such as Terraform, and exports the SBOM as CycloneDX / SPDX. Stored SBOMs are re-checked periodically against newly published CVEs. These audits run on our own 13 repositories (as of October 27, 2026).
Orange hands its findings directly to Purple Codens / Red Codens, which generate fix PRs automatically. After the fix, Orange re-reviews and APPROVEs once the issue is resolved. The handoff → fix PR → APPROVE → auto-merge loop takes about 8 minutes on average. Handoff is a suggestion gate before merge; auto-ticketing happens at PR merge, and Bot-authored PRs are excluded by loop guards.
Orange uses the Codens Suite's shared credit model (1 credit = JPY 0.01) and bills only for what you use. Measured directly from the BCP billing ledger (operation_type=orange.review, n=1,273 billed reviews, 2026-07-08 to 2026-07-27), the median PR review costs about 79 credits (roughly JPY 0.8), and the top 10% by diff size (p90) costs about 258 credits (roughly JPY 2.6). On the Pro plan (JPY 10,000/month = 1M credits), that's roughly 12,000 reviews at the median. Credits are shared across all products in the same plan, including Red, Blue, Green, and Orange. See the pricing simulator for a detailed estimate.
CodeRabbit excels at inline PR comments and has strong adoption in English-speaking markets. Orange Codens goes further: it hands off findings to Purple Codens / Red Codens to auto-generate fix PRs, cross-checks the PR diff against the PRD in Green Codens to catch requirement gaps, and supports Japanese-language PR comments, JPY credit billing, and JST support.
Orange Codens is designed to minimize noise. Low-confidence findings are rolled up into the summary instead of posted inline, and inline comments are reserved for higher-severity findings. Critical findings can act as a pre-merge gate, reducing the flood of low-confidence comments that typically cause review fatigue.
Orange's security review runs LLM-based SAST, secret scanning, and dependency vulnerability detection (SCA/SBOM), and maps findings to OWASP Top 10 / CWE Top 25-equivalent categories. High-severity findings go through a two-stage Verify pass with an Opus model before being reported.
Yes. PR review comments support Japanese (toggle to English), billing uses JPY credits, and support is available in JST.
Orange's review results and security audit logs are recorded as PR comments, so they can serve as audit evidence. Orange Codens itself is currently in Closed Beta, and SOC2 certification for Orange is planned for a future stage.