Angular Code Review — PR Reviewer

Review Angular code changes directly on your Pull/Merge Request pages! Angular Code Review is a lightweight, secure browser extension designed to help code reviewers identify Angular-specific issues, RxJS memory leaks, change detection bottlenecks, and security vulnerabilities directly within the pull request interface of GitHub, GitLab, Azure DevOps, and Bitbucket. Ideal for senior developers, tech leads, and reviewers who want to ensure enterprise-grade code quality before merging. WHERE THIS EXTENSION APPEARS: The "Angular Review" button only appears when you're viewing an actual pull/merge request page on a supported platform: - github.com/<owner>/<repo>/pull/<id> - gitlab.com/<path>/-/merge_requests/<id> - dev.azure.com/<org>/<project>/_git/<repo>/pullrequest/<id> - bitbucket.org/<workspace>/<repo>/pull-requests/<id> It does nothing and injects nothing on any other page, including other pages within these same sites (e.g. repo home pages, issue lists, dashboards). KEY FEATURES: 1. Static Analysis (100% Offline & Private)Scans changed .ts and .html files instantly on page load. Runs checks locally in your browser for 9 critical Angular rules, including: • Missing OnPush change detection strategy. • Missing trackBy / track expressions in loops (ngFor and @for). • Unmanaged RxJS subscriptions causing memory leaks. • Nested subscriptions (suggesting flattening via switchMap/mergeMap). • Unsanitized [innerHTML] bindings, in both templates and component code (cross-site scripting vectors). • Leftover console.log, debuggers, and "any" types. • Performance-heavy function calls inside templates. 2. Smart Review ChecklistAn interactive audit checklist covering Change Detection, RxJS, Forms, Type Safety, Error Handling, Accessibility (a11y), Security, Testing, and more. • Integrated Auto-Verification: If the static analysis scan finds zero violations for a rule, the corresponding checklist item is automatically checked and marked "✓ verified" — and automatically re-evaluated if new findings appear later. • Checklist states are stored locally per PR/MR so you never lose your progress. 3. Markdown Report ExportDownload a complete report of all static findings in a clean markdown format — perfect for pasting as a PR comment or saving for compliance reviews. 🔜 COMING SOON: Optional AI-powered auditing (bring your own API key — Anthropic, OpenAI, DeepSeek, or a custom OpenAI-compatible server) is planned for a future release. It is not included in this version — everything above works fully without it. PRIVACY & SECURITY FIRST: • No Code Leaves Your Machine: All analysis runs 100% locally in your browser. • Minimal Permissions: Only requests "storage" (to save your platform tokens and checklist state) and the official REST API domains of the four supported platforms — no broad host access, no browsing history, no analytics or telemetry. • Token Security: Personal access tokens are stored in your local browser profile (chrome.storage.local) and are only ever sent, as an authorization header, to the official API of the platform they belong to — never to any other server. SUPPORTED PLATFORMS: • GitHub (github.com) — PAT optional • GitLab (gitlab.com) — PAT optional • Azure DevOps (dev.azure.com) — PAT required • Bitbucket Cloud (bitbucket.org) — App Password required ACCESS TOKEN SETUP REQUIRED FOR SOME PLATFORMS: Before reviewing a PR/MR, open the extension's Options page (right-click the extension icon → Options) and add the relevant access token: - GitHub / GitLab: optional — works unauthenticated for public repos (rate-limited); add a token for private repos or higher limits. - Azure DevOps / Bitbucket: REQUIRED — these platforms don't allow unauthenticated API access, so the extension cannot fetch PR data without a token/App Password configured first. Without the required token, you'll see an authentication error when trying to review a PR on Azure DevOps or Bitbucket.