review-walkthroughs

Review Walkthroughs

Overview

Each walkthrough follows the full review flow:

1. Detect — identify the issue using the relevant skill (security, performance, language-specific)
2. Calibrate — assign confidence level (C1–C4) and severity using review-accuracy-calibration
3. Write feedback — apply the comment template from review-feedback-quality
4. Decide — Request Changes, Approve with Comment, or Approve

Skills loaded in each scenario are listed explicitly. Use these walkthroughs to calibrate your own review process or to onboard reviewers to the full diagnostic flow.

Scenario Summary

#	Language	Issue Type	Confidence	Severity	Verdict
1	Python	SQL Injection	C4 Certain	CRITICAL	Request Changes
2	Go	N+1 Query / performance	C3 High	HIGH	Request Changes
3	TypeScript	AI-generated: hallucinated API, stale closure, missing error handling	C3 High	HIGH	Request Changes
4	Java	Unsynchronized shared state / concurrency	C4 Certain	CRITICAL	Request Changes

Scenario 1: Security Bug in Python Flask API

Context: A PR adds a /users/search endpoint to a Flask API. The endpoint accepts a query parameter and fetches matching users from a PostgreSQL database.

Skills loaded: security-patterns-code-review, review-accuracy-calibration, review-feedback-quality, python-review-patterns

Step 1: Detect

Scanning the endpoint handler for injection vectors — user input flows directly into a SQL string.

# Before: vulnerable endpoint
from flask import Flask, request
import psycopg2

app = Flask(__name__)
conn = psycopg2.connect("dbname=myapp user=postgres")

@app.route("/users/search")
def search_users():
    query = request.args.get("q", "")
    cursor = conn.cursor()
    # VULNERABILITY: string interpolation in SQL
    sql = f"SELECT id, name, email FROM users WHERE name LIKE '%{query}%'"
    cursor.execute(sql)
    rows = cursor.fetchall()
    return {"users": [{"id": r[0], "name": r[1], "email": r[2]} for r in rows]}