Bob Secure Review

Teams ship more code now than they can read. AI wrote much of it, and AI reviews it — and that is where the trust breaks. An AI code reviewer that works and an AI reviewer that is broken produce the same output. So does a reviewer that never read the file at all. "No findings" is a verdict, not evidence: it looks identical whether the tool examined your code or merely said the words. Security teams already know this feeling — a scanner that reports clean after silently failing is worse than no scanner, because it retires the vigilance it did not earn. **Bob Secure Review** is a code reviewer that has to earn the right to say clean. Its users are the people who ship and review AI-written code: developers, security reviewers, and CI pipelines. They use it the way they use any reviewer — point it at a file or a repository and get findings with severity, category, and line ranges. What makes it different is a gate that runs before any clean result is allowed to count. Before Bob Secure Review may report that your code has no problems, it must first catch a vulnerability planted in a file it was not told about. And it must stay silent about that same rule on a copy of the file with the flaw removed. That second half matters more than the first. A reviewer that always shouts "vulnerable" passes a detection test and fails this one. Requiring silence on the clean twin forces the reviewer to discriminate — to show its output is a relation between the input and the code, not a script that fires regardless. There is a third state, and it is the point. When the reviewer cannot establish that discrimination — when the twin is too different, or too degenerate, to serve as a control — the verdict is withheld. Not clean. Not clean with a caveat. The system says it could not prove itself, and declines to answer. The margin that decides this is computed from the inputs rather than tuned: the twin is compared against a deterministically shuffled copy of the same source. There is no constant to calibrate and nothing to drift. The result is a reviewer whose all-clear is earned rather than asserted — and which reports a failure as a failure, including when the failure is its own.