Code Review

Review Categories

1. Security Review

Check for: - SQL injection vulnerabilities - XSS (Cross-Site Scripting) - Command injection - Insecure deserialization - Hardcoded secrets/credentials - Improper authentication/authorization - Insecure direct object references

2. Performance Review

Check for: - N+1 queries - Missing database indexes - Unnecessary re-renders (React) - Memory leaks - Blocking operations in async code - Missing caching opportunities - Large bundle sizes

3. Code Quality Review

Check for: - Code duplication (DRY violations) - Functions doing too much (SRP violations) - Deep nesting / complex conditionals - Magic numbers/strings - Poor naming - Missing error handling - Incomplete type coverage

4. Testing Review

Check for: - Missing test coverage for new code - Tests that don't test behavior - Flaky test patterns - Missing edge cases - Mocked external dependencies

Review Output Format

## Code Review Summary

### 🔴 Critical (Must Fix)
- **[File:Line]** [Issue description]
  - **Why:** [Explanation]
  - **Fix:** [Suggested fix]

### 🟡 Suggestions (Should Consider)
- **[File:Line]** [Issue description]
  - **Why:** [Explanation]
  - **Fix:** [Suggested fix]

### 🟢 Nits (Optional)
- **[File:Line]** [Minor suggestion]

### ✅ What's Good
- [Positive feedback on good patterns]

Common Patterns to Flag

Security

// BAD: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
await db.query(query, [userId]);

Performance

// BAD: N+1 query
users.forEach(async user => {
  const posts = await getPosts(user.id);
});

// GOOD: Batch query
const userIds = users.map(u => u.id);
const posts = await getPostsForUsers(userIds);

Error Handling

// BAD: Swallowing errors
try {
  await riskyOperation();
} catch (e) {}

// GOOD: Handle or propagate
try {
  await riskyOperation();
} catch (e) {
  logger.error('Operation failed', { error: e });
  throw new AppError('Operation failed', { cause: e });
}

Review Checklist

• [ ] No hardcoded secrets
• [ ] Input validation present
• [ ] Error handling complete
• [ ] Types/interfaces defined
• [ ] Tests added for new code
• [ ] No obvious performance issues
• [ ] Code is readable and documented
• [ ] Breaking changes documented