1,375 blocking issues stopped before they reached staging.

From July 16 to September 27, 2026, Hyrax reviewed every pull request in Synter's core repository: 792 pull requests and 8,458 files, with a median of 3 minutes each. It stopped 1,375 blocking issues before they merged.

What Synter needed

Synter's agents execute advertising campaigns, manage real spend and handle live credentials across 27 ad platforms. The team ships hundreds of pull requests a month and cannot afford a cross-tenant leak, an authentication lapse or an unmetered write endpoint.

How Hyrax fits the pipeline

Hyrax runs as a gate in Synter's CI/CD pipeline. Findings go into the pull request review threads, blocking issues stop the merge, and over the 10 weeks Hyrax opened 28 fix pull requests.

What Hyrax found

2,250 findings were posted in pull request review threads. By category:

1. Authentication, authorization and tenant isolation846
2. Core business logic and contract invariants645
3. API route and schema invariants275
4. React state, effects and UI correctness136
5. Test quality and flakiness128
6. Concurrency and race conditions108
7. High-severity vulnerabilities (SSRF, XSS, IDOR)59
8. Memory, stream and resource leaks53

Five catches that mattered

1. Live ad spend without a spend check

   A refactor removed the checks that stop campaigns from running without approved spend. Hyrax blocked the pull request before it merged.

2. Ownership check bypass on ad updates

   One connection type skipped the check that a user owns the campaign they are editing. Hyrax flagged it before the code reached staging.

3. Server-side request forgery in a URL checker

   A tool accepted user URLs without blocking private network addresses. Hyrax flagged it and opened a fix PR that validates the URL.

4. Reflected XSS in an OAuth error page

   Query parameters went into an HTML error response without escaping. Hyrax found it and opened a fix PR that escapes the output.

5. Approval queue scoped to the wrong boundary

   A query filtered by user instead of by organization, so one tenant's queue could drift from another's. Hyrax blocked the PR, and Synter added a permanent regression test that cites the catch.

The numbers