EarnIn scales regulated code review with CodeRabbit after choosing buy over build

Challenge: AI accelerated code creation, so review capacity had to rise with it

EarnIn uses AI across planning, specification, code generation, documentation, research, and agentic coding workflows. As engineers produced code faster, pull request review became an even more important control point.

Review depth could vary by repository and reviewer availability. Senior reviewers also spent time on formatting, naming, import order, and boilerplate feedback instead of higher-order engineering concerns such as trust boundaries, idempotency, rollout safety, data integrity, authorization, reliability, and architecture.

EarnIn's teams span several time zones. The organization needed a reviewer that could meet developers as soon as a pull request opened, provide a consistent first signal, and leave human attention for the decisions that benefit most from experience and judgment.

EarnIn chose a purpose-built review layer

EarnIn approached AI code review with a platform mindset and explored an internal build path first.

Yes, we did make an attempt to create a very generic instruction or prompt focused code review tool.

— Kashyap Parikh

That effort clarified how much sits behind a useful AI reviewer: fast execution, reliable infrastructure, broad repository awareness, adjacent-file and dependency context, configuration, feedback loops, and a workflow built specifically around pull requests.

The team settled on a clear separation of responsibilities: one set of tools for code generation and a dedicated system for code review.

We decided we should have a separate, completely separate, tool, one for code generation and the other which is trained specifically for doing the reviews.

— Kashyap Parikh

Maintaining internal runners, expanding context, tuning prompts, managing latency, and building repository-aware intelligence would have required continued investment. CodeRabbit gave EarnIn a mature review platform that fit the existing GitHub workflow.

Why CodeRabbit: PR-native workflows, analytics, and flexible governance

EarnIn ran a structured proof of concept across multiple AI code review products, evaluating inline review quality, configurability, pull request workflows, and organization-wide analytics.

CodeRabbit offered stronger PR-centric workflows, richer org-level analytics, and more flexible configuration options.

— Kashyap Parikh

Four capabilities stood out:

• Clear inline review signals. Severity and category labels help engineers quickly triage feedback on functional correctness, stability, performance, data integrity, maintainability, security, and privacy.
• Organization-wide analytics. Platform leaders can measure acceptance rates, comment volume, and estimated reviewer time saved across the GitHub organization.
• Deterministic enforcement in CI/CD. EarnIn pairs AST-grep rules for must-follow policies with CodeRabbit's inline findings.
• First-reviewer automation. Mobile teams require developers to address CodeRabbit feedback before tagging human reviewers, creating cleaner handoffs and more focused conversations.

Implementation: A governed rollout across hundreds of repositories

EarnIn first enabled organization-level auto-review so repositories received immediate first-pass coverage inside GitHub. It then introduced repository-level .coderabbit.yaml files that inherit from a central configuration repository. This created a shared baseline while allowing teams to tune review depth, tone, and repository-specific guidance.

Next, EarnIn connected AST-grep rules to its CI/CD workflows. CodeRabbit surfaces those deterministic findings inline alongside AI-generated review comments, bringing policy enforcement and contextual review into the same developer experience.

The first wave produced value quickly. In the first few weeks of the proof of concept, CodeRabbit reviewed more than 1,000 pull requests, and EarnIn engineers were already accepting a meaningful share of its suggestions.

EarnIn continues to tune this living review system through central standards, repository context, deterministic rules, human judgment, and AI-powered first-pass coverage.

CodeRabbit catches the issues that matter in financial services

EarnIn sees the most value when CodeRabbit catches issues with operational, financial, or customer-trust impact.

1. Functional correctness and stability. CodeRabbit finds logic bugs, missing error handling, and incorrect state transitions. In one example, it flagged broken idempotency logic in a shipping-update handler where the deduplication check could never trigger in production.
2. Data integrity. Findings include Proto3 enum default-value risks, nullable-field mismatches between domain models and database schemas, and missing validation on externally sourced data.
3. Security, privacy, and maintainability. CodeRabbit flags overly broad IAM permissions in Terraform changes, missing authorization checks on new endpoints, and dead code or unused fields that build technical debt.

Once we have code written by an agent, we want to ensure the quality of the code meets the standards that we have set for humans. And CodeRabbit is one of the really important tools for our developers.

— Kashyap Parikh

CodeRabbit supports a regulated SDLC

EarnIn maintains PCI v4 and SOC 2 Type II compliance through an SDLC that includes monitoring, observability, disaster recovery, change management, and documented code review.

CodeRabbit supports that process without replacing human judgment. Every pull request receives an AI-assisted first pass, while human review remains part of EarnIn's regulated change-management flow. CodeRabbit provides broad coverage and fast feedback before reviewers focus on design, architecture, edge cases, and cross-system implications.

Results: 5,000+ pull requests reviewed without flooding the workflow

In a recent snapshot, EarnIn merged more than 5,000 pull requests across hundreds of active repositories. CodeRabbit reviewed that stream with more than 8,000 comments and an overall acceptance rate of approximately 60%.

The review load stayed focused. CodeRabbit averaged roughly 1.5 comments per pull request, compared with roughly 2.0 comments from human reviewers. Engineers could resolve useful first-pass feedback early, leaving human reviewers to concentrate on architecture, product intent, operational risk, edge cases, and cross-system behavior.

Across the same period, CodeRabbit saved approximately 12 weeks of human reviewer effort. For a distributed engineering organization operating hundreds of repositories, that recovered capacity creates more room for design discussions, platform work, and production readiness.

A cleaner review rhythm across teams and time zones

Every pull request now gets an immediate first pass. On iOS and Android teams, CodeRabbit acts as a mandatory first reviewer: developers address its feedback before inviting human reviewers into a cleaner, higher-signal conversation. Backend teams use it as a fast advisory loop before the human review begins.

One mobile engineer described pull requests arriving to teammates as:

Already green and approved by the rabbit.

Developers get earlier feedback, reviewers spend more time on thoughtful engineering, and platform leaders gain measurable adoption and quality signals. EarnIn can keep AI-assisted development moving while preserving the review discipline required of a modern financial services platform.