code-review-checklist

Follow a structured checklist covering functionality, security, performance, code quality, tests, and documentation. Start by understanding the problem being solved, then verify edge cases, input validation, error handling, and test coverage before approving.

Check for SQL injection by verifying parameterized queries, prevent XSS by escaping output, confirm authentication and authorization checks, ensure no hardcoded secrets or API keys, and validate all user inputs. Also audit dependencies for known vulnerabilities.

Use specific comment templates that show the problematic code, provide a suggested fix, and explain why the change improves the code. Ask questions instead of assuming, focus on important issues rather than nitpicks, and acknowledge good patterns.

Common mistakes include approving without reading the code, ignoring security issues, skipping test verification, giving vague feedback, and rubber-stamping changes. Reviewing when tired or without understanding the broader context also causes missed issues.

A checklist does not replace running the code locally, environment-specific validation, or expert judgment for complex architectural decisions. Treat checklist output as a starting point and stop to clarify when requirements, permissions, or success criteria are unclear.