postgresql-code-review

Submit the existing SQL, migration, or function for review against PostgreSQL-specific checks covering JSONB indexing, array operators, data types, constraints, and security. The output is a verdict, a severity-ranked findings table with evidence, and corrected SQL ready to paste.

postgresql-code-review audits existing PostgreSQL code and migrations for antipatterns, quality, and security. postgresql-optimization is for creating or tuning new PostgreSQL features rather than reviewing existing ones.

JSONB containment queries using the @> operator should be backed by a GIN index, for example CREATE INDEX idx_orders_data ON orders USING gin(data). Queries like data->>'status' = 'x' cannot use standard indexes and should be rewritten with containment operators.

Yes. The review verifies RLS is enabled on sensitive tables, that policies use appropriate roles and settings like current_setting('app.current_user_id'), and that privileges are granted granularly instead of broad GRANT ALL statements.

Use TIMESTAMPTZ for any column storing points in time, such as created_at or updated_at, because it stores timezone-aware values. Plain TIMESTAMP loses timezone context and causes bugs across servers in different zones.

Concatenated input enables SQL injection. The review requires all parameters to be bound through JPQL, Spring Data derived queries, or parameterized native queries, and flags any string-built SQL as a high-severity finding.