code-review

Code Review Skill

Overview

Comprehensive code review checklists, patterns, and best practices for conducting thorough, constructive code reviews across multiple languages and frameworks.

Capabilities

• Security vulnerability detection
• Performance issue identification
• Code quality assessment
• Best practices enforcement
• Architecture review
• Test coverage analysis

---

Code Review Checklist

1. Functionality ✅

Core Requirements:

• Code implements the specified requirements
• Edge cases are handled
• Error handling is comprehensive
• Business logic is correct
• No hardcoded values (use configuration)

Testing:

• Unit tests are present and comprehensive
• Integration tests cover critical paths
• Test names are descriptive
• Mocks are appropriate
• Coverage meets project standards (typically 80%+)

---

2. Security 🔒

OWASP Top 10:

• No SQL injection vulnerabilities
• No XSS (Cross-Site Scripting) vulnerabilities
• No CSRF (Cross-Site Request Forgery) vulnerabilities
• No insecure deserialization
• Authentication is properly implemented
• Authorization checks are in place
• Sensitive data is not logged
• Secrets are not hardcoded

Input Validation:

// ❌ Bad: No validation
function updateUser(data) {
  return db.users.update(data);
}

// ✅ Good: Validate input
function updateUser(data: UpdateUserDTO) {
  validateEmail(data.email);
  validateAge(data.age);
  sanitizeInput(data.bio);
  return db.users.update(data);
}

SQL Injection Prevention:

# ❌ Bad: String concatenation
query = f"SELECT * FROM users WHERE id = {user_id}"

# ✅ Good: Parameterized query
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

Authentication:

// ✅ Check authentication on protected routes
if (!req.user || !req.user.isAuthenticated) {
  return res.status(401).json({ error: 'Unauthorized' });
}

// ✅ Check authorization
if (req.user.id !== resource.ownerId) {
  return res.status(403).json({ error: 'Forbidden' });
}