Junior, senior, or AI: same repo, different habits.
Lintora checks every change against the policies you turned on and keeps quality consistent.

Overview, examples, and common questions

Before and after — login credentials in the URL versus POST body

async function login(user, pass) {
  const res = await fetch(`/login?user=${user}&pass=${pass}`);
  return res.json();
}

async function login(user: string, pass: string) {
  const res = await fetch(`/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ user, pass }),
  });

  if (!res.ok) {
    throw new Error(`login_failed:${res.status}`);
  }

  return res.json();
}

Lintora Overview

Lintora is a policy enforcement tool for codebases that ensures consistent quality across human and AI-generated code. It runs a versioned catalog of named policies on JavaScript and TypeScript, reports structured findings with stable IDs, and supports the same workflow locally and in CI.

Key Features

• Policy-based code validation
• AI-aware rule enforcement
• CI/CD integration
• PR-level feedback

Use Cases

• Teams using AI coding tools
• Scaling engineering teams
• Enforcing internal standards
• Governing JavaScript and TypeScript before merge

Use case: AI-assisted feature ships an unsafe default

A model-generated pull request adds a new API client with permissive TLS, silent error swallowing, and credentials read from query strings. ESLint stays green because the file is formatted and imports resolve. Lintora flags the security and validation policies you enabled, cites each hit with a stable policy ID, and blocks merge until the team fixes or explicitly waives the rule. The same bar applies whether the author is a human or an agent.

Pull request review example

Thread mirrors the policy spotlight above: same catalog-style message, root cause, and fix text Lintora emits for that rule.

• Lintora SEC-001-027 (CRITICAL): Sensitive credential pattern in URL — align with token exposure guard.
• Why it matters: query strings show up in browser history, reverse proxies, and analytics.
• Author: Switched login to POST + JSON body and added `res.ok` handling so secrets are not carried on the URL.

Common questions