Code Review Checklist

Quick Review Checklist

Correctness

• Code does what it's supposed to do

• Edge cases handled

• Error handling in place

• No obvious bugs

Security

• Input validated and sanitized

• No SQL/NoSQL injection vulnerabilities

• No XSS or CSRF vulnerabilities

• No hardcoded secrets or sensitive credentials

• AI-Specific: Protection against Prompt Injection (if applicable)

• AI-Specific: Outputs are sanitized before being used in critical sinks

Performance

• No N+1 queries

• No unnecessary loops

• Appropriate caching

• Bundle size impact considered

Code Quality

• Clear naming

• DRY - no duplicate code

• SOLID principles followed

• Appropriate abstraction level

Testing

• Unit tests for new code

• Edge cases tested

• Tests readable and maintainable

Documentation

• Complex logic commented

• Public APIs documented

• README updated if needed

AI & LLM Review Patterns (2025)

Logic & Hallucinations

• Chain of Thought: Does the logic follow a verifiable path?

• Edge Cases: Did the AI account for empty states, timeouts, and partial failures?

• External State: Is the code making safe assumptions about file systems or networks?

Prompt Engineering Review

// ❌ Vague prompt in code const response = await ai.generate(userInput);

// ✅ Structured & Safe prompt const response = await ai.generate({ system: "You are a specialized parser...", input: sanitize(userInput), schema: ResponseSchema });

Anti-Patterns to Flag

// ❌ Magic numbers if (status === 3) { ... }

// ✅ Named constants if (status === Status.ACTIVE) { ... }

// ❌ Deep nesting if (a) { if (b) { if (c) { ... } } }

// ✅ Early returns if (!a) return; if (!b) return; if (!c) return; // do work

// ❌ Long functions (100+ lines) // ✅ Small, focused functions

// ❌ any type const data: any = ...

// ✅ Proper types const data: UserData = ...

Review Comments Guide

// Blocking issues use 🔴 🔴 BLOCKING: SQL injection vulnerability here

// Important suggestions use 🟡 🟡 SUGGESTION: Consider using useMemo for performance

// Minor nits use 🟢 🟢 NIT: Prefer const over let for immutable variable

// Questions use ❓ ❓ QUESTION: What happens if user is null here?