# How code review works

> devlo reviews each new pull request and posts one GitHub review with a summary and inline comments. See when it runs, what it reads, and what a review contains.

devlo reviews each new pull request and posts one GitHub review with a summary and inline comments. The built-in **Code Reviewer** automation runs reviews, and it’s on for every connected repository by default. Each review uses [credits](/account/plans/). Code review works on every plan, including Free.

## When a review runs

* A pull request is opened, drafts included. Pull requests from bot accounts, including devlo’s own, are skipped by default.
* Someone comments `/review` on a pull request.

devlo doesn’t review again on its own, for example after new commits. Comment `/review` for a new review, or to review one that was skipped.

## What devlo reads

* The diff and the code around it.
* Your [review instructions](/code-review/customize/), and `review.md` or [`AGENTS.md`](/coding/writing-tasks/#repository-instructions) in the repository.
* What it learned from your earlier feedback.
* A Jira ticket that the pull request references, when Jira is connected.

Reviews focus on bugs, security, and performance, and keep style nitpicks to a minimum. If devlo finds nothing, the review has a summary and no inline comments.

## What a review looks like

**devloai**botreviewed

### PR Summary:

* Adds token refresh to the session middleware

### Review Summary:

One expiry check mixes seconds and milliseconds.

### Suggestions

* Add a test for expired tokens **[Apply](#)**

***

⚡ **[Apply all quick fixes](#)** (2 quick fixes)

**devloai**botreviewed

`src/auth/session.ts`

This compares the token expiry in seconds with `Date.now()` in milliseconds, so every token looks expired.

Suggested change

```ts
  return token.expiresAt * 1000 < Date.now();
```

⚡ **[Apply quick fix](#)**

* **Suggested change** is a GitHub suggestion that **Commit suggestion** applies without devlo.
* **Apply quick fix**, **Apply all quick fixes**, and **Apply** have devlo make the change. See [Apply fixes from a review](/code-review/quick-fixes/).
* devlo adds a thumbs up and a thumbs down to each inline comment. Select one to vote. See [Teach devlo](/code-review/customize/#teach-devlo).

## What a review doesn’t do

* It doesn’t approve unless the repository’s **Approve pull requests** setting is on.
* It never requests changes or adds a status check, so it never blocks a merge.
* It can’t be canceled once it starts.

## See what reviews changed

Owners and admins can see which recommendations made it into merged code on [Performance](/contribution/performance/) and [Outcomes](/contribution/outcomes/), and review comments by category and severity on [Quality](/analytics/quality/). Categories and severities don’t show on GitHub.

## Next steps

[Run, re-run, or turn off reviews](/code-review/running-reviews/)

[Apply fixes from a review](/code-review/quick-fixes/)

[Customize reviews](/code-review/customize/)