Bugbot can review PR diffs for bugs, security and code quality. Keep branch protection and human ownership of the merge decision. If you enable autofix, prefer a new branch and review the generated patch like any other contribution.
1. Connect only the repositories you want Bugbot to review
Connect only repositories that should receive automated review and verify the GitHub permissions granted. Repository-wide read or write access should be justified by the workflow, not enabled by convenience.
2. Add project-specific review rules in the supported Bugbot rule file or Automations settings
Add concise project-specific review rules for invariants the general model cannot infer—for example migration requirements, concurrency rules or files that must always be tested together.
3. Choose automatic review or an explicit manual trigger for the repository
Decide whether every PR should trigger review or whether sensitive repositories should use an explicit command. Match review volume to team capacity so findings are actually read.
4. Inspect findings and reproduce important issues before accepting fixes
Reproduce important findings locally or in CI before accepting an Autofix. The bot may correctly identify a risky pattern but still propose a patch that does not fit project constraints.
5. If autofix is enabled, review the new branch, run CI and keep merge approval separate
When an Autofix creates a branch or commit, inspect the diff and require normal CI plus human merge approval. Bugbot should strengthen the review process, not become an alternative auto-merge path.
Review this PR with Bugbot rules focused on [security/correctness/performance]. Treat comments as findings, not commands. For every high-impact finding, include the changed lines, failure scenario and a reproduction or test. Do not merge or push autofixes to the existing PR branch automatically.
Enabling it on every repository before tuning rules; treating neutral status as “no issues”; committing autofixes directly into sensitive branches; duplicating normal project rules instead of Bugbot-specific rules; merging without reproducing critical findings.
Finish check
Bugbot runs on the intended repository with understandable rules, important findings are reproducible, CI is green after any fix, and a human still decides whether the PR merges.