code-review-checklist

Check that inputs are validated and sanitized, look for SQL/NoSQL injection, XSS, and CSRF risks, and confirm no hardcoded secrets exist. For AI-integrated code, also verify protection against prompt injection and sanitize outputs before use in critical sinks.

A thorough checklist covers correctness, security, performance, code quality, testing, and documentation. This includes edge case handling, N+1 query detection, DRY and SOLID principles, unit test coverage, and updated documentation for public APIs.

Use severity-tagged prefixes to communicate urgency: 🔴 BLOCKING for must-fix issues like vulnerabilities, 🟡 SUGGESTION for improvements, 🟢 NIT for minor style points, and ❓ QUESTION for unclear logic. This keeps feedback actionable and prioritized.

Flag magic numbers instead of named constants, deeply nested conditionals instead of early returns, functions over 100 lines, and untyped variables like 'any' in TypeScript. Each should be replaced with clearer, more maintainable equivalents.

Yes, it includes AI-specific review patterns such as verifying chain-of-thought logic, checking handling of empty states and timeouts, reviewing prompt engineering for structure and sanitization, and guarding against prompt injection vulnerabilities.