Sealmerge

Self-hosted, for teams on GitLab

A GitLab review bot that only posts problems it can prove

Sealmerge reviews every merge request on your own server with your own model key, and each comment shows the evidence behind it.

Request a free pilot See how it works
  • Runs with docker compose up
  • Your own model key
  • Code never stored

acme/checkout !42

Apply discount codes at checkout

Sealmerge review High risk 7 proven findings 6 to check manually

src/checkout/discount.ts +18 

@@ -0,0 +1,18 @@
5+export async function findCode(code: string): Promise<Code | null> {
6+  const found = await db.discountCodes.find(code);
7+  if (!found) return null;
8+  // Expired codes don't apply.
9+  if (found.expiresAt < found.createdAt) return null;

Sealmerge @sealmerge

Medium correctness

Expired codes still accepted

findCode() compares expiresAt with the creation date instead of now, so a code never expires.

Evidence: src/checkout/discount.ts:9 compares code.expiresAt with code.createdAt

Suggested change 

9-  if (found.expiresAt < found.createdAt) return null;
9+  if (found.expiresAt < new Date()) return null;
10+  return found;
11+}
12+
13+export const applyDiscount = (total: number, code: Code) => percentOff(total, code.percent);

What Sealmerge posts on merge requests

A summary on every push

One comment at the top says what changed, how risky it is and why. It is updated on every push, with what the review cost.

Sealmerge review · High risk · 7 proven findings · 6 to check manually

What changed Adds discount codes at checkout: a code is looked up when the cart total is computed and its percentage taken off, with a new table for the codes.

  • High payment: src/checkout/discount.ts, src/checkout/cart.ts
  • High migration: db/migrations/0042_discount_codes.sql

Review details · 8 files · 51,450 tokens · $0.31

A short list to check by hand

Sealmerge lists the few places a person should read closely. Reviewers tick each one off in Sealmerge, which records who did it and when.

Check manually · 2 of 6 signed off

  • src/checkout/cart.ts lines 12–14 · finding: Discount applied twicesigned off by demo-reviewer, 2026-11-06 10:42 UTC
  • src/checkout/discount.ts line 9 · finding: Expired codes still acceptedsigned off by demo-reviewer, 2026-11-06 10:44 UTC
  • db/migrations/0042_discount_codes.sql line 1 · finding: Migration has no down step
  • src/checkout/discount.ts line 13 applyDiscount

Every finding is checked first

Each comment ends with an evidence line: the file, line and code that show the problem. If Sealmerge can't prove a finding, it is never posted.

  1. Claim findCode() compares expiresAt with the creation date instead of now.
  2. Looked up in the code src/checkout/discount.ts:9 compares code.expiresAt with code.createdAt
  3. Judged again With only the claim and that code in front of the model.
  4. Posted: Expired codes still accepted Dropped: Code lookup races with deletion

Where your code goes

Your GitLab Merge requests in, comments out

Sealmerge reads with a bot token and writes only its own comments.

Sealmerge, on your server Keeps findings and metadata, code never stored

  • The code under review, with your key

    Your model provider Anthropic first, and compatible endpoints

  • Only the names of new packages

    npm and PyPI To check their age and downloads; can be turned off

  • Nothing

    Us, the Sealmerge team Unless your admin opts in to anonymous thumbs counts, with no code and no names

Code execution is off by default. If your admin turns it on, checks run in a sandbox container with no network and with CPU, memory and time limits.

Questions, and how to try it

Does it work with gitlab.com?

Yes. Self-managed GitLab comes first, and gitlab.com works too.

Which model providers does it support?

Anthropic first, with a base URL override for compatible endpoints. You bring the key; Sealmerge never uses a key of its own for your reviews.

Does Sealmerge run our code?

Not unless your admin turns code execution on. When it is on, checks run only in the sandbox described above.

Does it replace human review?

No. It tells your reviewers what to read closely, and they sign off each place; it doesn't block merges.

Try it on your GitLab

Ask for a free pilot or a place on the waitlist. Only your email is needed; we reply by email.

I'd like

Or email us at hello@sealmerge.com. What the form sends, and where: privacy.