When the tool reviewing your app also reviews itself

I have been running RepoLens against PatternSorcerer — another CycleRunCode Club product — so the reports are not demo fluff. They are real findings on a shipping macOS app, and they also forced RepoLens itself to get better at telling the truth.

Below are cropped views of the actual Markdown reports RepoLens wrote (same structure you get in reports/). The finding format stayed stable (impact, remediation, code examples on Critical/High). What changed was mode honesty, filenames, timestamps, and metrics.

Snapshot 1 — Full review (25 July 2026)

• Mode: review (P1 security → P2 reliability → P3 architecture)
• Gate confidence: 77% (adequacy of the review package — not “% secure”)
• Counts: Critical 0 · High 6 · Medium 16 · Low 11
• Filename: gate_review_report_2026-07-25.md (date-only)
• What it shows well: End-to-end structure already present—severity counts, checklist metrics, and code-example fixes on High findings such as export-path injection in CodeExportService.swift.

Snapshot 2 — Early sentinel (31 July 2026)

• Mode: sentinel (security-only guardrail)
• Counts: Critical 0 · High 1 · Medium 14 · Low 6
• Bug: Gate confidence printed as 0%, and P2/P3 confidence also showed 0%, even though those passes were never run
• Filename: gate_review_report_2026-07-31.md (still date-only, easy to overwrite)
• Why this snapshot matters: A security-only run must not look like a failed full audit. Students and shipping teams need the report to say what actually ran.

Snapshot 3 — Stamped sentinel (5 August 2026, 09:42)

• Mode: sentinel, with mode in the filename
• Generated: 2026-08-05 09:42
• Duration: 22m 59s (useful for long local-model jobs)
• Gate confidence: 90% for the security package that actually ran
• Counts: Critical 0 · High 1 · Medium 14 · Low 6 (same security finding shape; honest scoring)
• Filename: gate_review_report_sentinel_2026-08-05_0942.md
• What improved: Unscored bands are omitted, runs do not clobber each other, and you can compare stamped reports over time.

What stayed the same (on purpose)

Across all three runs the narrative shape stayed teachable:

• P1 findings still call out export/injection and input-validation risks in PatternSorcerer’s code export and extract tools
• Critical/High items still carry Explanation, Impact, Recommended fix, and a code example
• Gate confidence is never sold as a marketing “% secure” score

Products to open next

• RepoLens product page — install, modes (review / sentinel), and feedback links
• PatternSorcerer product page — the macOS regex workshop these reports were run against

Source and issues: github.com/vksvicky/RepoLens · Open an issue

If you want to try the same loop in a club session, get in touch.