code-reviewer

Code Reviewer

Five-axis structured code review. Finds what matters, ignores what doesn't, and produces actionable feedback — not a style lecture.

When to Use

• "Review this code"
• "Check my PR"
• "Is this safe to merge?"
• "What could go wrong here?"
• Before merging any non-trivial change

The Five Axes

Review in this order. Stop at critical findings — don't bury them.

Axis 1 — Correctness

Does the code do what it claims?

• Does it handle the happy path correctly?
• What about empty inputs, null values, zero, negative numbers?
• Are there off-by-one errors in loops/slices?
• Are async operations awaited correctly?
• Are there race conditions if called concurrently?
• Do error paths clean up resources (files, connections, locks)?

Severity: Any correctness bug is at minimum MEDIUM. Incorrect behavior in production = CRITICAL.

Axis 2 — Security

Does the code introduce vulnerabilities?

Checklist:

• SQL/NoSQL injection (string concatenation in queries)
• Command injection (user input in shell commands)
• Path traversal (user-controlled file paths)
• XSS (unsanitized user content rendered as HTML)
• Secrets in code (API keys, passwords, tokens hardcoded)
• Insecure deserialization (pickle, eval, exec on user data)
• Authentication bypass (missing auth checks on routes)
• Overly permissive CORS or CSP
• Sensitive data in logs

Severity: Any security finding is CRITICAL or HIGH. Flag immediately, don't bury in a list.

Axis 3 — Performance

Will this code be fast enough at scale?

• N+1 queries (DB query inside a loop)
• Missing database indexes for the query pattern
• Blocking I/O in async code
• Unnecessary data fetching (SELECT * when 2 columns needed)
• Memory leaks (event listeners not removed, caches unbounded)
• Expensive operations in hot paths (JSON parse per request, etc.)

Only flag if the code will actually run at meaningful scale. Don't micro-optimize cold paths.

Axis 4 — Maintainability