code-review-checklist

Follow a structured checklist covering functionality, security, performance, code quality, tests, and documentation. Start by understanding the problem the code solves, then verify edge cases, error handling, input validation, and test coverage before approving.

Check that all user inputs are validated, queries use parameterized statements to prevent SQL injection, secrets come from environment variables rather than hardcoded values, and authentication and authorization checks are present where needed.

Use a template that states the issue, shows the current code, provides a suggested fix, and explains why the change is better. Be specific with examples, ask questions instead of assuming, and focus on important issues rather than minor style nitpicks.

Common mistakes include approving without reading the code, ignoring security issues, skipping test verification, giving vague feedback, and rubber-stamping reviews. Reviewing when tired or without understanding the broader context also causes missed issues.

Do not approve when tests are missing or failing, security vulnerabilities like injection risks exist, edge cases are unhandled, or the code is too unclear to understand. Request specific changes with examples instead of a vague rejection.