How Nursa rebuilt its platform in 7 months without losing quality with CodeRabbit

Challenge: Building the verification system for an AI-first engineering organization

A full-stack AI bet

In early 2025, Nursa committed to becoming an AI-first engineering team. It adopted Cursor, then Claude Code, and started generating code faster than traditional review could keep up with. At the same time, the team was rewriting the frontend, migrating to a new technology stack, and launching new product lines.

We went all in. We started generating a lot of code, and obviously, reviewing that, just like we did before, reading through all of the code as human beings, became impossible to do.

— Maks Majer, VP of AI Technology at Nursa

A distributed team with time-zone gaps

Nursa's engineering team works across Warsaw, Banja Luka, São Paulo, Belgrade, and the United States. Before CodeRabbit, code-ownership rules meant US engineers often had to wait for European reviewers to approve merges. Reviews could sit idle across time zones, slowing a team committed to moving quickly.

Trunk-based development raised the stakes

To support the pace of AI-assisted development, Nursa moved away from release trains and long-lived branches. Every pull request merged to main now deploys directly to production.

The biggest risk is that we as developers struggle to review all the code that is being produced. Trunk-based development along with AI has greatly increased the amount of code we ship daily. It becomes impossible for a human to closely review all that code while also working on their own tasks.

— Tim Walzer, Principal Software Engineer at Nursa

Replacing a gate the team no longer trusted

For more than a year, Nursa used SonarQube Cloud as a required quality gate on every pull request. The team valued automated checks, but its experience of the gate became a source of friction.

The problem was never that we didn't want quality checks. It was that Sonar's checks were noisy, flaky, slow, and opinion-based, blocking merges on things that weren't real problems.

— Maks Majer, VP of AI Technology at Nursa

Nursa engineers saw recurring problems: fully tested changes sometimes showed 0% coverage after a branch sync, deleting a test did not always trigger the gate, and complexity or style findings could block merges even when risk was low. The separate CI step added about 20 minutes, and unrelated merges could change the analysis result.

Nursa removed SonarQube Cloud from its required checks and chose a review model aligned with the way the team now builds software. CodeRabbit replaced the required Sonar gate with contextual pull-request review focused on whether a change was correct and how it fit the surrounding code.

SonarQube enforced a rigid, opinionated definition of code quality. It wasn't always clear how that mapped to real quality. CodeRabbit focused on correctness and how changes fit the bigger picture. Code quality matters, but correctness matters more.

— Tim Walzer, Principal Software Engineer at Nursa

How Nursa built a review system for AI-generated code

Nursa evaluated CodeRabbit alongside Bugbot, GitHub's native tools, and Cursor's built-in capabilities. The team needed a reviewer that understood context, respected its standards, and could be tuned to match how it built software.

Calibrated by experienced engineers

The rollout was deliberate. Nursa's most experienced engineers reviewed every CodeRabbit comment at the beginning, separating useful signal from noise.

At the beginning, we had a lot of false positives. But we made sure that we got to a point where CodeRabbit would actually catch the most important things, the biggest risks.

— Robert Jelic, Principal Engineer at Nursa

The team tuned CodeRabbit across repositories using path-specific instructions and learnings. Nursa cut down on nitpicking, focused reviews on what mattered, and encoded its quality standards into the process.

The team also defined the boundary of automation. Very large pull requests can still require deeper human review, and stacked pull requests can produce extra findings. CodeRabbit handles baseline review; Nursa's engineers retain judgment over architecture, business rules, and sensitive areas.

Three findings that made the value real

Nursa operates in a regulated domain. Its credentialing platform handles personal and potentially regulated information, so sending sensitive data to the wrong system can create privacy, security, and compliance problems.

During the rebuild, CodeRabbit caught three such issues before merge and production:

1. A full event object serialized into a log line. Sensitive data would have gone to a logging platform with different access and retention rules than the primary datastore. CodeRabbit recommended logging a non-identifying summary instead.
2. A candidate's email address written to logs. The application would have logged it at the beginning and end of every candidate-creation flow, steadily accumulating personal data outside the primary store. CodeRabbit recommended retaining only non-personal identifiers.
3. Sensitive information rendered in a failure-alert email. Emailing that content would have moved data into recipients' inboxes, outside the source system's controls.

None were logic bugs. The code worked and tests passed. Moving fast through a regulated domain, the value was a reviewer that flags, 'you're about to write some sensitive data somewhere it doesn't belong,' on every PR.

— Robert Jelic, Principal Engineer at Nursa

CodeRabbit caught some possible leakage of sensitive data. Not even my local development flow caught it. I started leaning more on it, feeling more secure seeing things like that raised.

— Robert Jelic, Principal Engineer at Nursa

Over six months, Nursa engineers accepted 65.4% of CodeRabbit's comments. When CodeRabbit flagged a serious issue, the team acted on seven out of ten findings.

The operating model Nursa built

Engineering excellence became leverage, not output

The rebuild changed how Nursa defines strong engineering. Its leadership team is evolving its competency matrix as engineers progress from using AI to write code, to orchestrating agentic workflows, to designing AI-powered products with evaluations and guardrails, and ultimately to helping entire teams use AI well. The emphasis is moving from code volume to responsible AI use, reduced complexity, team velocity, shared practice, and customer impact.

At Nursa, we're trying to move away from evaluating engineers purely by what they produce and toward evaluating the leverage they create. In an AI-first environment, writing code is no longer the scarce skill. The scarce skills become understanding problems deeply, making good technical decisions, orchestrating AI effectively, and ensuring the quality of what ultimately reaches production.

— Guilherme Fontes, Director of Engineering at Nursa

The engineer who writes the most code won't necessarily be the strongest engineer anymore. The strongest engineer is the one who consistently creates the most value with the least unnecessary effort while maintaining high quality and helping everyone around them become more effective.

— Guilherme Fontes, Director of Engineering at Nursa

Results: Shipping with confidence at AI-assisted speed

Rebuilding a seven-year platform in seven months across a distributed team, with AI generating code and every merge deploying to production, left little room for uncertainty. Nursa's review system gave engineers a consistent second set of eyes on every pull request.

What I saw, standing on the sidelines watching what they were doing technically, was increasing confidence that they could actually ship things and rely on CodeRabbit. For engineers who are great at their level, it removed the hesitation. They weren't second-guessing whether they'd created a bug in production.

— Nenad Ivanovic, VP of Product at Nursa

Bigger pull requests without a bigger review burden

AI-generated code changed the economics of pull requests for Nursa. Generating code became inexpensive; reviewing it remained scarce.

We increased the size of our PRs. Generating code is so cheap, and being able to review more at the same time is what CodeRabbit gives us.

— Maks Majer, VP of AI Technology at Nursa

Fewer time-zone bottlenecks

With CodeRabbit providing baseline review across the codebase, Nursa relaxed ownership requirements in non-sensitive areas. A US engineer no longer had to wait for a specific reviewer in Europe to come online before every merge. Areas requiring designated human approval remained protected.

CodeRabbit has been helping the engineering team at Nursa scale code reviews by combining AI with team context, so quality and velocity improve without creating review bottlenecks like we used to have when we relied on code owners alone.

— Guilherme Fontes, Director of Engineering at Nursa

Nursa's next frontier: Verifying autonomous agents

Nursa is extending the same systems thinking to more autonomous agents—what Maks calls a "dark software factory," in which AI handles more of the software development lifecycle. The central unsolved problem is verifiability.

Giving agents verifiability of work is what can make it run truly autonomously.

— Maks Majer, VP of AI Technology at Nursa

Security is part of that challenge. Maks is particularly concerned about indirect prompt injection: malicious instructions embedded in data an agent is expected to read.

Nobody needs to jailbreak the model. They just need the agent to read their text and treat it as an instruction.

— Maks Majer, VP of AI Technology at Nursa

His conclusion is that agentic systems require a different trust model: anything an agent reads is input, every tool call is an action, and the boundary exists at every tool call.

For the team that rebuilt seven years of product in seven months, the next chapter is already underway. Nursa is defining how agents, automated review, and human judgment work together, and CodeRabbit is part of the verification layer that supports that model.

It's the code reviewer designed for the agentic era when a human can no longer cope with the output and the agent needs a trusted feedback loop to produce it at the right quality level.

— Maks Majer, VP of AI Technology at Nursa