code-review

Start by reading the PR description and checking scope, then review architecture and design, inspect code details like naming and error handling, audit security and performance, verify test coverage, and finish with prioritized constructive feedback.

Verify input validation, authentication and authorization checks, password hashing, and protection against SQL injection, XSS, and CSRF. Also confirm there are no hardcoded secrets and that dependencies are up to date without known vulnerabilities.

Be specific by referencing exact lines and suggesting concrete alternatives with code examples. Prioritize issues as critical, important, or nice-to-have, explain why something is a problem, and acknowledge good work alongside criticisms.

Watch for god classes handling too many responsibilities, magic numbers instead of named constants, deep nesting instead of early returns, code duplication, dead code, and silent error swallowing without logging.

Linters like pylint, eslint, and clippy catch style issues, while Bandit, npm audit, and OWASP Dependency-Check flag security problems. SonarQube and CodeClimate provide broader code quality analysis.