The Quiet Crisis Nobody in E-commerce Is Talking About: Your Codebase Is Now Your Supply Chain
Every cross-border seller I know obsesses over the same metrics: conversion rate, AOV, ad spend efficiency, shipping times. We track CAC like it’s a heartbeat and LTV like it’s a retirement account. But there’s a bottleneck that’s quietly strangling growth for every DTC brand and Amazon operation that has graduated from “hacked-together Shopify theme” to “actual software business” — and it’s not inventory or logistics. It’s the fact that your engineering team, if you have one, is drowning in code they can’t safely review. And if you’re using AI coding agents — and you are, whether you admit it or not — the problem is about to get ten times worse.
Here’s the uncomfortable truth: the same AI tools that let a two-person brand team ship a custom loyalty program or a marketplace integration in a weekend are also producing code at a volume no human can meaningfully audit. The bottleneck has shifted. It’s no longer “can we build it?” It’s “can we trust what got built?” For an e-commerce operator, this isn’t an abstract engineering concern. It’s the difference between a checkout flow that works and one that silently fails on a promo code edge case during your biggest Q4 push. It’s the difference between a subscription billing integration that holds and one that churns customers because a renewal date got miscalculated. This is why I spent a week digging into Ito, a runtime code review tool that just launched on Product Hunt, and why I think every serious e-commerce operator should be paying attention — even if you don’t write a line of code yourself.
What Ito Actually Does: Stop Reading Code, Start Running It
Let me be direct about what Ito is, because the pitch sounds almost too simple. The company, founded by a team of MIT engineers (Evan Marshall and Dennis Garcia among them), took a look at the entire code review industry and concluded that it’s fundamentally broken. Every existing tool — and I’ll name names in a moment — operates on the same flawed premise: that you can evaluate code by reading it. Static analysis, diff review, linting, even the AI-assisted review tools that have popped up in the last eighteen months — they all stare at the code and try to predict what might happen when it runs.
Ito’s bet is that this is backwards. Their tool doesn’t read your pull request and offer opinions. It builds your application in an isolated container, seeds it with data, provisions credentials, spins up real dependencies, and then drives the app like a user would — clicking, navigating, calling APIs, verifying database state — and posts the results back on the PR with video, logs, and screenshots. It’s not reviewing code. It’s testing the system that code produces.
The distinction matters more than you’d think. A static review tool can tell you that a function looks like it might have a race condition. Ito can actually trigger the race condition, show you the video of it happening, and tell you what broke. The maker team frames it as “runtime code review,” and they’re right to coin the term, because it’s a genuinely new category. On every pull request, Ito creates a test plan from the code, PR description, ticket, and your input, then executes against it with a swarm of agents that can catch the kinds of issues that only manifest when software is actually running: concurrency bugs, failure handling gaps, data migration errors, authentication problems.
For an e-commerce operator, translate that into your world. Your cart abandonment email flow has a bug that only appears when a customer uses a discount code and a gift card at the same time. Your inventory sync between Shopify and your 3PL fails silently when a SKU has a variant with zero stock. Your Amazon listing update tool breaks when a product has more than five images. Static review won’t catch any of these. Runtime testing will, because it’s actually running the scenario.
Why This Is Different From Everything You’ve Tried
I’ve watched the code review tooling space evolve over the last decade, and I’ve recommended plenty of them to e-commerce founders who are building out their internal tech. The incumbents fall into a few buckets. There’s the traditional static analysis crowd — SonarQube, CodeClimate — which are fine for catching style issues and obvious bugs but useless for anything that requires execution. There’s the CI/CD integrated testing layer — CircleCI, GitHub Actions — which runs whatever tests you’ve written but does nothing to generate new ones or explore edge cases you didn’t think of. And there’s the newer wave of AI review tools like Greptile that apply large language models to diff review, but they’re still fundamentally reading code, not running it.
The Ito team is explicitly dismissive of the “bolt a sandbox onto static review” approach, and they have a point. When asked directly about Greptile’s TREX feature, cofounder Grayson Cooper’s response was pointed: Greptile bolted on a sandbox to validate static review’s hypotheses, but it’s limited to mocks and unit tests without real credentials. Real applications, he argues, lean on S3, Stripe, auth providers, and other external services. If your review tool can’t access those, it’s not testing your app. It’s testing a simplified version of your app, which is exactly the kind of false confidence that gets you in trouble.
Here’s where it gets interesting for e-commerce specifically. Ito’s philosophy is that mocks are the last resort, not the default. Their team’s answer to a question about external services was revealing: they prefer to test with real services, spinning up real local databases, caches, queues, and even sibling services in multi-repo setups. For third-party APIs — Stripe, PayPal, your payment gateway, your shipping rate calculator — they let customers securely share credentials so the test runs against the real thing. Only when a service is genuinely unreachable do they mock it, and crucially, every test result discloses what was mocked and what was real. A pass that leaned on a mock never looks the same as a pass against the live service.
For an e-commerce operator, this is the difference between testing your checkout flow against a fake payment processor and testing it against the actual Stripe test environment with real API keys. It’s the difference between discovering that your shipping rate calculation works in isolation and discovering that it breaks when the warehouse API returns a timeout and your error handling doesn’t catch it. The fidelity matters, because e-commerce is a domain where integrations are the product.
Why Amazon Sellers Should Care More Than Shopify Ones
If you’re running a Shopify store with a standard theme and a few apps, you might be wondering why any of this matters to you. Fair question. Your technical surface area is small, and you’re probably not writing much custom code. But if you’re an Amazon FBA seller running any kind of automation — repricing tools, inventory management, review generation, PPC optimization — you’re relying on software that has the same problems Ito is solving. And if you’re a brand that’s grown past the “just a store” phase, with a custom loyalty program, a subscription offering, or a marketplace integration, you have a codebase that needs the same protection.
The stakes are higher on Amazon, though, because the platform punishes failure harshly. A bug in your inventory sync that causes overselling gets you a performance notification. A bug in your pricing automation that misprices a product gets you a buy box loss or worse. Amazon’s ecosystem is notoriously unforgiving of technical errors, and the cost of a bad deployment isn’t just lost revenue — it’s account health. That’s why I’d argue the runtime review approach is more valuable for Amazon-heavy operations than for pure Shopify DTC. The margin for error is thinner, and the consequences of shipping broken code are more severe.
What Cross-Border Sellers Can Steal From This Playbook
Here’s the part where I stop reviewing Ito as a product and start thinking about it as a philosophy that applies to how you run your e-commerce operation. Because even if you never install Ito — even if you don’t have an engineering team at all — there are lessons in how this tool thinks that are directly applicable to how you should be operating.
The first lesson is that verification should be continuous, not episodic. Ito doesn’t review your code once a quarter or when you remember to run tests. It reviews every single pull request, automatically, with the same rigor every time. Most e-commerce operators I meet treat testing — whether it’s A/B testing a landing page or testing a new app integration — as a discrete event. You run a test, you get results, you move on. But the tools and platforms you depend on are changing constantly. Shopify updates its API. Amazon changes its seller policies. Your payment processor changes its fraud detection. If you’re not continuously verifying that your stack still works, you’re flying blind.
The second lesson is about evidence. When Ito posts results on a PR, it includes video, logs, and screenshots. Not just a verdict — proof. For an e-commerce operator, this is the difference between a QA process that says “we tested it and it works” and one that says “here’s a video of a user completing a purchase with a discount code and a gift card, and here’s the log showing the inventory decremented correctly.” The latter is actionable. The former is vibes.
The third lesson is about feedback loops. Ito claims to get better the more you use it — it responds to feedback, learns how to navigate your application, and focuses reviews on the areas you care about based on what gets fixed versus ignored. That’s the same principle behind good e-commerce optimization. You’re not just running tests; you’re building a system that learns what matters to your business and gets sharper over time. If your A/B testing tool doesn’t learn from past experiments, or your ad platform doesn’t get smarter about your audience, you’re leaving value on the table.
Where the Math Breaks
I want to be clear-eyed about Ito’s limitations, because the product is early and the claims are ambitious. The pricing is aggressive — the first 100 reviews are free with no card required, then it’s $40/month after that, with free forever for open source projects. That’s cheap enough to try, but the real cost is in setup and trust. The tool needs access to your codebase, your credentials, your external services. For a small e-commerce team without a dedicated DevOps person, that’s a significant lift. And the team admits they don’t support iOS or macOS apps — they focus on things that can run in a Linux box — which is fine for most e-commerce backends but a hard no for mobile-first brands.
There’s also the question of false confidence. The tool is designed to catch runtime issues, but it’s not omniscient. It can’t test every possible user journey, and it can’t predict how real customers will behave differently from test agents. The team’s answer to a question about mocked calls was thoughtful — they flag exactly which parts of the evidence pack came from a mock versus a live call — but the underlying risk remains. A test that passes against a mocked Stripe response is not the same as a test that passes against Stripe’s actual sandbox, and a test that passes against Stripe’s sandbox is not the same as a test that passes against production traffic.
The deeper issue, though, is that Ito is solving a problem that most e-commerce operators don’t yet know they have. If you’re a two-person team running a Shopify store with off-the-shelf apps, you don’t have a code review problem. You have a “which apps do I trust” problem, and Ito isn’t going to help you there. The tool is for teams that are already building software — custom integrations, internal tools, marketplace automations — and are feeling the pain of AI-generated code outpacing their ability to verify it. If that’s not you yet, it might be soon, but it’s not you today.
What I’d Watch / Test Next
If you’re an e-commerce operator with an engineering team, or if you’re a solo founder who’s started writing custom code for your brand, here’s what I’d do this week:
Run Ito against a real PR in your codebase. The first 100 reviews are free, and there’s a public demo where you can see it work on open source PRs without signing up. Don’t just read the marketing — put it on a real change and see what it catches that your existing review process missed. Pay attention to whether the evidence pack (video, logs, screenshots) actually helps you understand the failure, or whether it’s just noise.
Map your critical e-commerce flows and ask which ones are actually being tested. Most teams have a testing gap for exactly the scenarios Ito targets: multi-step checkouts, subscription renewals, inventory edge cases, auth failures. Write down your five most important user journeys and ask honestly: if one of them broke, would your current tooling catch it before your customers did? If the answer is no, that’s your business case for runtime review.
If you’re using AI coding agents — and especially if you’re not — set a policy for verification before deployment. The Ito team’s origin story is telling: they came from fintech and cryptography, where a single mistake can cost tens of millions of dollars. Your stakes are lower, but the principle holds. If you’re going to let AI write code, you need AI-grade verification. That doesn’t have to be Ito — it could be a disciplined CI/CD pipeline with real integration tests — but it has to be something that runs the code, not just reads it.
The e-commerce stack is becoming a software business whether you like it or not. The tools that let you move faster are also creating new failure modes. Runtime verification is how you square that circle. It’s not the most glamorous part of running a brand, but it might be the most important one you’re not thinking about.
