code-review

Check for OWASP Top 10 issues: verify SQL queries are parameterized, endpoints have proper authorization checks, sensitive data is masked in responses and logs, and input is validated on the backend. This Skill provides a checklist covering each of these areas.

Look for N+1 database query problems, missing indexes, unclosed connections or file handles, inefficient loops and collection operations, and opportunities to cache expensive idempotent calculations. These are the core performance dimensions covered in the review checklist.

Organize comments into critical blocker issues with file and line references, non-critical improvement suggestions, positive highlights, and an actionable diff with suggested fixes. This format keeps feedback constructive and easy to act on.

Yes, the review pillars are language-agnostic, covering logic, security, performance, and maintainability. Some checklist items reference specific patterns like try-with-resources or JPQL, but the principles apply across languages and frameworks.

Checklist reviews catch common patterns but cannot replace runtime testing, dynamic analysis, or domain-specific verification. Complex business logic correctness and subtle race conditions may still require dedicated testing and profiling tools.