pr-reviewer

Description

Review pull requests and code diffs across any language. Finds logic bugs, missing tests, security holes, breaking API changes, and naming problems before they merge. Returns a structured report: block-merge issues first, then warnings, then style suggestions.

Use when

• "review my PR"
• "check this diff"
• "is this PR mergeable"
• "what's wrong with this change"
• "code review"
• Any git diff, patch file, or PR description paste

Supported languages

Any language with a git diff. Specialised checklist for: Python, JavaScript/TypeScript, C#, Go, Rust, Java/Kotlin, SQL migrations.

Input

Paste one of:

• A git diff (git diff main...feature-branch)
• A GitHub/GitLab PR URL (if accessible)
• Raw code with a description of what it changes

Optionally specify: target branch, framework, whether this is a library (breaking changes matter more) or an app.

Output format

## PR Review

### Block Merge
- [Finding] — [why this must be fixed before merging]
  ✗ Problem: [problematic code]
  ✓ Fix:     [corrected code]

### Warnings (fix before next release)
- [Finding] — [explanation]

### Suggestions (style / future-proofing)
- [Finding] — [explanation]

### Approved
- [Specific patterns done right — always include at least one]

### Summary
[2–3 sentences: biggest risk, top fix, overall verdict (merge / fix first / needs major work)]

Review checklist

Logic & correctness

• Off-by-one errors in loops or slices
• Null/nil dereference without guard
• Incorrect error handling (swallowed, wrong type checked)
• Wrong variable captured in closure/lambda
• Race condition introduced (shared mutable state, no lock)
• Missing edge case (empty input, zero value, max value)

Security

• User input used without sanitisation (SQL, shell, HTML)
• Secret or credential added to source (API key, password, token)
• Insecure deserialization
• Overly permissive CORS / auth bypass
• Path traversal risk

Tests

• New behaviour with zero test coverage
• Test that only tests the happy path (no error case)
• Mock that makes the test vacuously pass
• Missing assertion (test calls but never asserts)

API / interface

• Public method signature changed without deprecation
• Required parameter added to existing public function
• Return type narrowed or widened unexpectedly
• Serialised field renamed (breaks existing clients)

Performance

• N+1 query introduced
• Unbounded loop over user-supplied collection
• Synchronous I/O in async context
• Large allocation in hot path

Style

• Inconsistent naming with surrounding code
• Dead code left in (commented-out blocks, unused variables)
• TODO left without ticket reference
• Misleading variable/function name

Severity definitions

• Block Merge: Correctness bug, security hole, data loss risk, or breaking API change — must be fixed
• Warning: Performance issue, missing test coverage, or hard-to-debug behavior — fix before release
• Suggestion: Style, clarity, or maintainability improvement — up to the author

Self-improvement instructions

After each review, note the most common finding category (logic, security, tests, API, performance, style). After 20 reviews, surface the top 3 patterns as "Most common PR issues in [language]" to help users learn, not just fix.