Nothing to hand? Load the — an order service carrying most of the defects the rubric names — the , where some of the same constructs stop being defects because the shape is different, or the , which should come back ship-it with nothing invented.
Paste it — the scan is free
The browser lexes your source before any rule runs: comments (including /// docs), strings, verbatim @"" strings, interpolated $"" strings, raw strings and char literals are blanked out space-for-space, so a catch (Exception e) inside a doc comment never becomes a finding and every line number still lines up. Then it decides which shape you are on from weighted evidence — [ApiController] and app.MapGet against BackgroundService and Main against [Fact] and Assert — and falls back to class library rather than guessing when nothing is strongly present. Thirty-two rules then run against the structure it extracted, not against the text: types, methods, parameter counts, body spans, brace depth, field modifiers. Set Focus to narrow the pass and the free panel narrows with it, so what you see is what the review is asked to adjudicate. No upload, no AI, no cost.
On uploading, precisely: your code is sent once, when you press Review this code. The price meter beside the button updates as you type, but it prices the run from a same-length stand-in — the platform is told how big your paste is, never what is in it.
The AI reviews it — this is the metered part
A staff engineer's pass, in the shape the scan settled on: what is wrong, the consequence in this code rather than a rule name, the fix, and a before/after excerpt. Every finding has to quote a verbatim line from your paste, and the render path checks each quote against the source — anything it cannot locate is shown to you as unverified rather than presented as fact. The review also has to adjudicate every browser finding one by one: confirmed, or set aside with a reason that refers to your code — Console.WriteLine in a console app's user-facing output is set aside, the same call in a service is confirmed. Then a verdict it commits to: ship-it, tidy-first or rework. Pricing is honest too: a worst-case amount is reserved before the run and only what the run uses is charged — the meter next to the button shows both.
Fix it, paste it again
The fix does not have to be retyped. Where a finding quotes a “before” excerpt that appears exactly once in your paste, Copy PR suggestion gives you a GitHub review comment with a suggestion block anchored on the real line range, and Download .patch collects every such finding into a unified diff — excerpts that are structural, unlocatable or overlapping are left out rather than guessed at. Findings also export as CSV (with the verification result, and a status column pre-filled open for your tracker), and the whole review copies or downloads as Markdown or JSON.
Then paste the code again. Past reviews are saved to your account, not just this browser, and the next run opens with Since your last review: the deterministic rules diffed against the previous run's source, keyed on the code rather than the line number, saying what cleared, what is still there and what the edit introduced. That comparison is free — it is the browser scan on both sides, no model involved.
A derived work of @github/dotnet-best-practices, from the open-source awesome-copilot collection (MIT).