Hacktron now powers security review for every pull request in @RocketChat.
In the first 20 days of integration, Rocket․Chat has found and fixed 17 real vulnerabilities, including a critical-severity account takeover (CVE-2026-55666), and a token replay attack (CVE-2026-55759).
Each review ran in ~1-2 minutes, with accurate codebase and threat model context.
As @juliocfa_, Director of Security at @RocketChat put it:
"False positives become less frequent, improving accuracy and cutting the time spent triaging non-issues."
https://t.co/6kudrlLy7v
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
Why it matters
It shows what automated, source-aware PR review catches in practice: two real CVEs, including a critical account takeover, found within three weeks of turning it on.
