Estimated time: 10–25 min

Code Review Checklist

A structured, non-bloated code review checklist for software teams, senior engineers, and AI-generated code reviews. Covers correctness, security, performance, architecture, data safety, and AI audit gates.

#Code Review#Pull Request#Software Engineering#Security#Architecture#Performance#AI Code Review

Phase Preset:

Progress:0%0 of 58 completed

1. Functional Correctness & Logic

Ensure the code satisfies business requirements and handles boundary conditions cleanly without unexpected side effects.

0/5 checks

Requirements and acceptance criteria alignmentBlockingReviewer

Boundary and edge case handlingBlockingReviewer

Invalid input and unexpected state defenseImportantReviewer

Logical assumptions and invariant checksImportantSenior Dev

Failure path execution and error propagationBlockingReviewer

2. PR Scope & Change Containment

Keep changes focused on the specific feature or fix to simplify review and prevent regression risks.

0/4 checks

Single responsibility scope containmentImportantReviewer

Solution complexity ratioSuggestionTech Lead

Accidental regression radius checkBlockingSenior Dev

No stray files or debug leftoversNitReviewer

3. Readability & Maintainability

Write code for humans first. Ensure future engineers can understand and modify this code easily.

0/4 checks

Intent-revealing naming conventionsSuggestionReviewer

Function length and nesting depth controlSuggestionReviewer

DRY vs premature duplication abstractionSuggestionReviewer

Comments explain 'Why', not obvious 'What'NitReviewer

4. Architecture & Modular Design

Maintain clean boundary separation, proper dependency flow, and consistency with existing codebase patterns.

0/4 checks

Separation of concerns and module boundariesImportantSenior Dev

Dependency direction and couplingImportantTech Lead

Consistency with existing codebase conventionsSuggestionReviewer

Justification of new abstractionsSuggestionSenior Dev

5. Error Handling & Resilience

Gracefully handle failures, clean up resources, and provide clear error diagnostic messages.

0/4 checks

No swallowed exceptions or empty catch blocksBlockingReviewer

Meaningful error messages and status codesImportantReviewer

Resource cleanup and disposalBlockingReviewer

Fallback behavior and retry limitsImportantSenior Dev

6. Security & Sensitive Data Protection

Identify authorization flaws, injection risks, secret exposures, and improper data logging proportional to the change risk.

0/5 checks

Authentication and session state verificationBlockingSecurity / Reviewer

Authorization and tenant isolation (IDOR check)BlockingSecurity / Reviewer

Injection attack defense (SQL, Command, XSS)BlockingReviewer

Zero committed credentials or secretsBlockingReviewer

PII and sensitive data log redactionBlockingReviewer

7. Performance & Resource Allocation

Prevent query degradation, N+1 loops, memory leaks, and thread-blocking operations.

0/5 checks

N+1 database query and loop I/O eliminationBlockingReviewer

Redundant network requests and payload sizeImportantReviewer

Non-blocking async executionBlockingReviewer

Memory allocation and object churn in hot loopsImportantSenior Dev

Caching implications and invalidation strategyImportantSenior Dev

8. Concurrency, State & Transactions

Prevent race conditions, thread deadlocks, duplicate execution, and corrupted shared mutable state.

0/4 checks

Race condition and shared mutable state checksBlockingSenior Dev

Thread safety and lock deadlocksBlockingSenior Dev

Request idempotency and duplicate execution defenseImportantSenior Dev

Transaction atomicity and rollback gatesBlockingSenior Dev

9. API Contracts & Backward Compatibility

Protect public interfaces, prevent breaking schema changes, and manage API evolution safely.

0/4 checks

Public API contract stabilityBlockingReviewer

Request/response schema backward compatibilityImportantReviewer

Strict payload validation changesBlockingReviewer

Deprecation notices and migration noticesImportantReviewer

10. Data Integrity & Database Safety

Safeguard database migrations, indexes, foreign keys, and data integrity under production loads.

0/4 checks

Zero-downtime database migration safetyBlockingDBA / Senior Dev

Query index coverage for filter/sort columnsImportantReviewer

Foreign key constraints and data integrityImportantReviewer

Safe data backfills and batch chunkingImportantSenior Dev

11. Automated Testing & Verification

Ensure test coverage actually verifies behavior rather than just inflating line coverage metrics.

0/4 checks

Unit and integration test coverage for modified pathsBlockingAuthor / Reviewer

Meaningful assertions (no empty/tautological checks)ImportantReviewer

Test determinism and flakiness preventionImportantReviewer

Realistic mocking scope (avoid testing mock behavior)ImportantReviewer

12. Observability & Production Diagnostics

Ensure failures in production leave enough diagnostic log traces and telemetry metrics to debug effectively.

0/3 checks

Structured contextual loggingImportantReviewer

Business telemetry metrics and alert hooksSuggestionSenior Dev

Production diagnosability without local reproductionImportantReviewer

13. Documentation & Knowledge Transfer

Keep documentation, API specs, inline code comments, and changelogs up to date with implementation changes.

0/3 checks

Inline code comments for non-obvious algorithmsNitReviewer

API specs and OpenAPI schema updatesImportantReviewer

Environment variables and deployment release notesImportantReviewer

14. Audit Gate: AI-Generated Code Review

Specialized sanity checks for PRs written or assisted by AI agents (Cursor, Claude Code, GitHub Copilot).

0/5 checks

Hallucinated API and dependency verificationBlockingReviewer

Subtle boundary logic and off-by-one verificationBlockingReviewer

Boilerplate and dead code strippingSuggestionReviewer

Unvetted security assumptions & default credentialsBlockingSecurity / Reviewer

Alignment with codebase idioms and architectural patternsImportantSenior Dev

Standardized PR Feedback

Classifying Review Findings by Severity

Not all review comments carry equal weight. Clearly prefixing your feedback helps PR authors prioritize changes and avoids blocking minor style preferences.

BlockingMust Fix

Critical Defect

Broken requirements, security vulnerabilities (SQLi/IDOR), memory leaks, data corruption, or failing tests.

blocking: Tenant ID check missing in DB query

ImportantShould Fix

High Risk / Tech Debt

N+1 query performance risks, missing error bounds, unhandled async rejections, or missing edge case tests.

important: Loop triggers HTTP call per item

SuggestionNon-Blocking

Improvement

Cleaner abstractions, better intent-revealing names, guard clause flattening, or minor DRY refactoring.

suggestion: Extract guard clause to flatten loop

NitTrivial

Minor Preference

Typo in JSDoc comment, minor formatting preference, or non-functional polish. Author may ignore.

nit: Typo in function comment ('retreive')

Pragmatic Triage

Context-Aware Reviewing: Match Depth to Change Risk

A 10-line CSS spacing fix does not require database transaction analysis. Conversely, a zero-downtime database migration warrants deep concurrency, locking, and index inspection. Adjust your focus using context presets:

UI & CSS Changes

Focus on visual correctness, responsive layouts, accessibility (a11y), and clean component prop interfaces. Skip DB & backend checks.

Backend & API Endpoints

Focus on correctness, authentication, tenant isolation (IDOR), input sanitization, error propagation, and non-blocking I/O.

Database Migrations

Focus on zero-downtime safety, non-null column defaults, index coverage, transaction rollbacks, and locking implications under load.

Special Audit Protocol

Best Practices for Reviewing AI-Generated Code

AI agents (Claude Code, Cursor, Copilot) write plausible code quickly, but introduce distinct failure modes. Keep these 5 rules in mind during AI code audits:

Verify Library & API Existence

AI models frequently hallucinate non-existent package methods or pass deprecated parameter schemas. Cross-check imported helper calls.

Inspect Off-By-One & Boundary Logic

AI models optimize for happy path outputs. Pay strict attention to loop bounds (< vs <=), negative array offsets, and zero-value limits.

Audit Security Assumptions

Verify the AI hasn't disabled CORS, bypassed authorization middleware, or hardcoded dummy secrets (`'secret-key'`) to make code pass tests.

Strip Verbose Dead Boilerplate

AI output often includes excessive try/catch wrappers, redundant logging, and unused helper functions. Demand clean, lean code.

How to Avoid Reviewing Only Style Instead of Correctness

The most common mistake in engineering teams is spending 80% of code review time arguing over formatting, quote styles, and variable naming while missing race conditions or authorization bypasses.

Automate Formatting via CI

Enforce Prettier, ESLint, or Biome formatting rules in pre-commit hooks and CI pipelines. Never comment on formatting in PRs manually.

Focus Human Attention on Intent

Use human review time exclusively for business logic correctness, data integrity, architecture boundaries, and edge case resilience.

When to Use This Checklist

Before approving non-trivial Pull Requests or Merge Requests in GitHub/GitLab.
During peer code review sessions to enforce consistent engineering quality standards across team members.
As a pre-review self-check before requesting peer or tech lead reviews.
When reviewing AI-generated code (Claude Code, Cursor, Copilot) to catch hallucinated APIs and subtle logical edge cases.

Common Pitfalls to Avoid

Bikeshedding on syntax formatting, indentation, and variable naming while missing concurrency deadlocks or data corruption risks.
Treating every minor PR like a full security audit or database architecture redesign instead of sizing review depth to risk.
Rubber-stamping PRs without running tests or verifying that assertions actually exercise failure paths.
Accepting AI-generated code blindly without inspecting unvetted security assumptions or missing boundary checks.