backend-code-review

Backend Code Review

Conduct systematic backend code reviews to identify security vulnerabilities, performance bottlenecks, code quality issues, and architectural concerns. Produces actionable reports with specific locations and fix recommendations.

Review Process

Follow this structured approach for comprehensive backend code analysis:

1. Assess Technology Stack and Scope

Identify technologies and critical areas before starting:

Technology Inventory:

Backend Language: Node.js/Python/Java/Go/C#
Framework: Express/FastAPI/Spring Boot/Gin/ASP.NET
Database: PostgreSQL/MySQL/MongoDB/Redis
Architecture: Monolith/Microservices/Serverless
Deployment: AWS/GCP/Azure/Docker/Kubernetes

Critical Review Areas (prioritize these):

• Authentication and authorization logic
• Payment processing and financial transactions
• Data access layers (ORM queries, raw SQL)
• External API integrations and webhooks
• Background jobs and async processing
• File upload and download handlers

Example Scope Definition:

Review: User authentication service
Files: src/auth/*.ts (15 files, ~2000 lines)
Priority: High (handles user credentials and sessions)
Focus: Security vulnerabilities, JWT implementation, session management

2. Review Code Quality and Structure

Evaluate code organization, design patterns, and maintainability:

Code Organization Checklist:

☐ Proper layering (controllers → services → repositories → database)
☐ Consistent file and folder naming (kebab-case, camelCase, etc.)
☐ One class/function per file (or logically grouped)
☐ No circular dependencies between modules
☐ Clear separation of business logic and infrastructure code

SOLID Principles Validation:

Single Responsibility: Each class/module has one reason to change

// ❌ Bad: UserService does too much
class UserService {
  createUser() { }
  sendEmail() { }       // Should be EmailService
  processPayment() { }  // Should be PaymentService
}

// ✅ Good: Separated responsibilities
class UserService {
  createUser() { }
}
class EmailService {
  sendEmail() { }
}
class PaymentService {
  processPayment() { }
}