Step-by-Step Study Material
Step 1: Understanding the Problem (The "Why")
The Core Problem
Before AI Bots:
Writing Code ──► PR Review ──► Deploy ──► Monitor ──► Fix Issues
Fast Slow Slow Slow Slow
Key insight: AI tools like Cursor already made writing code faster. But everything after the PR remained slow, manual, and error-prone.
Specific Pain Points
| Problem | Why It's Hard |
|---|---|
| Catching regressions after deploy | Requires constant monitoring + deep context |
| Security review on every PR | Needs specialized expertise, time-consuming |
| Knowing which change broke something | Multiple changes deploy simultaneously |
| Ensuring code is secure | Easy to miss subtle vulnerabilities |
Think of it this way: Imagine building a car faster but still needing weeks to do safety inspections manually. The bottleneck just shifted.
Step 2: Understanding Rollouts Bot
What Is It?
Rollouts is an automated deployment watchdog — it monitors your code from the moment a PR opens until you're confident it works in production.
How It Works (Step by Step)
PR Opens
│
▼
Rollouts reads the diff
│
▼
Writes a Monitoring Plan:
• Risks identified
• Expected effects
• Gaps in instrumentation
│
▼
[You review/edit the plan]
│
▼
Code Deploys
│
▼
Rollouts compares signals vs. pre-deploy baseline
│
├── Regression found? ──► Identifies suspect change
│ Takes configured action:
│ • Ping the author
│ • Pause progressive rollout
│ • Create revert PR
│
└── No regression? ──► Continues monitoring
Three Key Capabilities
1. Precision Regression Detection
- Catches issues in one endpoint in one region
- Acts before a global alert would even fire
- Think of it as catching a small leak before the pipe bursts
2. Intent Awareness
Traditional monitoring: Spike in traffic = ALERT 🚨
Rollouts: Deliberate spike (expected) = No alert ✓
Unexpected spike = ALERT 🚨
3. Pre-Merge Instrumentation Flagging
- Identifies missing monitoring before code merges
- This is critical because: you can't detect what you can't measure
Integrations
- Source control: GitHub, GitLab, etc.
- Deploy systems: Your CI/CD pipeline
- Telemetry: Datadog, Grafana, Honeycomb
Coming Soon
- Feature flag integration (ramp/unramp traffic directly)
- Awareness of release trains and deploy freezes
Step 3: Understanding Security Reviewer Bot
What Is It?
Security Reviewer is an automated security engineer that reviews every PR for vulnerabilities — with context of the entire codebase, not just the changed lines.
The Critical Difference: Context-Aware vs. Pattern-Matching
| Approach | Method | Problem |
|---|---|---|
| Static Analysis (old way) | Pattern matching | Flags every SQL string concatenation; misses broken auth after refactor |
| Security Reviewer (new way) | Reads code like a human engineer | Traces user input from entry → through system → to output |
Static Analysis thinks:
string + SQL call = flag it ⚠️ (often a false positive)
Security Reviewer thinks:
Where does user input ENTER the system?
What does it PASS THROUGH?
Where does it END UP?
Is it dangerous at any point?
What It Detects (6 Categories)
1. INJECTION ATTACKS
└── SQL, command, template, LDAP surfaces
2. AUTH FAILURES
└── Missing/broken authentication & authorization
on new AND changed routes
3. SECRETS EXPOSURE
└── Credentials committed to source code
4. UNSAFE OPERATIONS
└── Unsafe deserialization
└── Unvalidated redirects
5. DEPENDENCY VULNERABILITIES
└── New packages with known security issues
6. INSECURE CONFIGURATION
└── Insecure defaults in infrastructure/config
What Each Finding Includes
Every security finding gives you:
- Severity level — how dangerous is it?
- Attack path — how would an attacker exploit it?
- One-click fix — proposed solution ready to apply
Measured Impact
Review Time: 4.8 min ──► 3.8 min (21% faster)
Comment Acceptance: 45–50% ──► 60–70% (more useful findings)
Higher acceptance rate means fewer false positives — engineers trust and act on the findings
Step 4: Connecting the Concepts
How They Fit the "Self-Driving Codebase" Vision
Write Code ──► Cursor AI (already fast)
│
▼
Security Review ──► Security Reviewer Bot (automated)
│
▼
Merge & Deploy ──► Rollouts Bot (automated monitoring)
│
▼
Production Health ──► Rollouts Bot (automated response)
Both bots handle tasks that are:
- ✅ Hard (require expertise)
- ✅ Repetitive (happen on every PR/deploy)
- ✅ Context-heavy (need to understand the whole system)
Step 5: Quick Knowledge Check
Test yourself with these questions:
Q1: Why wasn't speeding up code writing enough to speed up software delivery?
Because post-PR work — security review, deployment monitoring, regression detection — remained slow and manual
Q2: What does Rollouts do before a PR merges?
It reads the diff and creates a monitoring plan identifying risks, expected effects, and instrumentation gaps
Q3: How is Security Reviewer different from static analysis?
It traces user input through the entire codebase contextually, rather than pattern-matching on code snippets
Q4: What three actions can Rollouts take when it finds a regression?
Ping the author, pause a progressive rollout, or create a revert PR for approval
Q5: Name three vulnerability types Security Reviewer detects.
Any three from: injection attacks, auth failures, committed secrets, unsafe deserialization, unvalidated redirects, dependency vulnerabilities, insecure config
Summary Card
┌─────────────────────────────────────────────────────┐
│ ROLLOUTS │
│ When: PR open → production │
│ What: Monitors deploys, catches regressions │
│ How: Monitoring plan + baseline comparison │
│ Acts: Ping / Pause rollout / Revert PR │
├─────────────────────────────────────────────────────┤
│ SECURITY REVIEWER │
│ When: Every PR │
│ What: Finds & fixes security vulnerabilities │
│ How: Contextual code reading (not pattern match) │
│ Acts: Reports severity + attack path + fix │
└─────────────────────────────────────────────────────┘
Both available on Teams and Enterprise plans