Review Pull Request

BUGS

SECURITY

PERFORMANCE

Approval standard

Review criteria

• Correctness: logic bugs, off-by-ones, race conditions, unhandled states, missing error paths
• Readability: functions > 50 lines, nesting > 2 levels, dead code, unused imports
• Security: exposed secrets, unvalidated external data
• Type safety & immutability:

  any

  or unjustified assertions; in-place mutation of shared data
• Patterns: consistent with codebase conventions, no reinvented wheels
• Performance: unnecessary re-renders, O(n²) where O(n) works
• Code smells: match the diff against the baseline in smells.md — always judgement calls; the repo's documented style overrides the baseline
• Dependency upgrades (manifest/lockfile in the diff): one dependency per change — a bulk bump that breaks hides which package did it; verify against the changelog, not the version number; review the lockfile diff (one direct bump pulls dozens of transitive changes); flag hand-edited lockfiles

Output

file:line

• Critical — must fix before merge (bugs, vulnerabilities)
• Suggestions — improvements worth considering
• Nit — minor and optional; label true nitpicks as Nit rather than dropping or inflating them
• FYI — informational
• Positives — good patterns to call out