Skip to main content
New: Change ReviewRead the release note
Hyrax
Sign inStart free
Customers · Synter

1,375 blocking issues stopped before they reached staging.

Synter's agents run live ad campaigns, spend and credentials across 27 ad platforms. For 10 weeks, Hyrax reviewed every pull request in its core repository.

Start freeWatch demo
1,375blocking issues stopped before merge
792pull requests reviewed in 10 weeks
1,360+engineering hours saved, as reported by Synter
Company
Synter
What it does
Autonomous agents for paid media
Repository
Core engineering repository
Period
July 16 to September 27, 2026

From July 16 to September 27, 2026, Hyrax reviewed every pull request in Synter's core repository: 792 pull requests and 8,458 files, with a median of 3 minutes each. It stopped 1,375 blocking issues before they merged.

What Synter needed

Synter's agents execute advertising campaigns, manage real spend and handle live credentials across 27 ad platforms. The team ships hundreds of pull requests a month and cannot afford a cross-tenant leak, an authentication lapse or an unmetered write endpoint.

How Hyrax fits the pipeline

Hyrax runs as a gate in Synter's CI/CD pipeline. Findings go into the pull request review threads, blocking issues stop the merge, and over the 10 weeks Hyrax opened 28 fix pull requests.

“Hyrax has been an indispensable automated gate in our CI/CD pipeline.”
Joel Horwitz, Founder & CEO, Synter

What Hyrax found

2,250 findings were posted in pull request review threads. By category:

  1. Authentication, authorization and tenant isolation846
  2. Core business logic and contract invariants645
  3. API route and schema invariants275
  4. React state, effects and UI correctness136
  5. Test quality and flakiness128
  6. Concurrency and race conditions108
  7. High-severity vulnerabilities (SSRF, XSS, IDOR)59
  8. Memory, stream and resource leaks53

Five catches that mattered

  1. Live ad spend without a spend check

    A refactor removed the checks that stop campaigns from running without approved spend. Hyrax blocked the pull request before it merged.

  2. Ownership check bypass on ad updates

    One connection type skipped the check that a user owns the campaign they are editing. Hyrax flagged it before the code reached staging.

  3. Server-side request forgery in a URL checker

    A tool accepted user URLs without blocking private network addresses. Hyrax flagged it and opened a fix PR that validates the URL.

  4. Reflected XSS in an OAuth error page

    Query parameters went into an HTML error response without escaping. Hyrax found it and opened a fix PR that escapes the output.

  5. Approval queue scoped to the wrong boundary

    A query filtered by user instead of by organization, so one tenant's queue could drift from another's. Hyrax blocked the PR, and Synter added a permanent regression test that cites the catch.

The numbers

792pull requests reviewed, every one in the period
8,458files reviewed across those pull requests
2,250findings posted in pull request review threads
1,375blocking issues stopped before merge
1,076of the findings were security or invariant issues
28fix pull requests opened by Hyrax
3 minmedian time to review a pull request
1,360+engineering hours saved, as reported by Synter

Synter's core engineering repository, July 16 to September 27, 2026. Figures reported by Synter.

Start free

Build what you're proud to ship.

Bring a Codebase Architect to your AI-native engineering workflow.

Start free

Hyrax is free to start. Full product, $30 starter credit, $10/month of credits. No credit card.