code-review

Code Review Best Practices

This skill activates when reviewing code for quality, correctness, security, and maintainability.

Anti-fabrication

This skill follows core:anti-fabrication, but has little to verify against an external source: the checklist and etiquette content is house convention (Google's review guide, cited in sources.md, for the checklist's shape), and "Language-Specific Considerations" is broad, stable idiom rather than versioned API claims. Don't assert a language-specific rule this skill doesn't cover without checking that language's own style skill first.

Code Review Checklist

1. Correctness and Functionality

Does the code do what it's supposed to do?

• Logic is correct and handles all cases
• Edge cases are considered
• Error handling is appropriate
• No obvious bugs or logical errors
• Assertions and validations are present
• Return values are correct

Questions to ask:

• What happens if this receives null/nil?
• What if the list is empty?
• What if the number is negative/zero?
• Are there off-by-one errors?
• Are comparisons correct (>, >=, <, <=)?

2. Security

Is the code secure?

• No SQL injection vulnerabilities
• No XSS (Cross-Site Scripting) vulnerabilities
• No CSRF vulnerabilities (CSRF protection in place)
• User input is validated and sanitized
• Sensitive data is not logged
• Authentication and authorization are properly implemented
• No hardcoded secrets or credentials
• File uploads are validated (type, size, content)
• External URLs are validated
• Rate limiting is in place for APIs

Worked BAD/GOOD examples (SQL injection, XSS, hardcoded secrets, mass assignment): references/checklist-examples.md.

3. Performance

Is the code efficient?

• No N+1 query problems
• Appropriate data structures chosen
• Algorithms are efficient
• Database indexes are used
• Caching is implemented where appropriate
• Large datasets are paginated or streamed
• Unnecessary computations are avoided
• Resources are cleaned up properly