AI-Powered Review Checklists

🔄 Quick Recall: In the previous lesson, you learned how AI handles the mechanical 60-70% of review work so humans can focus on judgment calls. Now you’ll build the specific review checklists that catch the bugs, security holes, and performance issues that slip through human review.

Effective code review isn’t about finding every possible improvement — it’s about catching the issues that would cause problems in production. AI review checklists make this systematic: instead of hoping the reviewer remembers to check for SQL injection, null handling, and resource leaks, AI checks every item on the list for every PR.

Bug Detection Checklist

AI prompt for bug review:

Review this code for potential bugs. Code: [PASTE CODE OR DESCRIBE THE FUNCTION]. Language: [LANGUAGE]. Check for: (1) Null/undefined handling — are there values that could be null or undefined that aren’t checked? (2) Off-by-one errors — in loops, array indexing, pagination, boundary conditions. (3) Race conditions — are there shared resources accessed without synchronization? (4) Resource leaks — are database connections, file handles, and network sockets properly closed in all paths (including error paths)? (5) Type errors — are there implicit conversions that could produce unexpected results? (6) Error handling — are exceptions caught with meaningful handling (not just swallowed)? (7) Edge cases — empty arrays, zero values, negative numbers, very large inputs. For each finding: severity (critical/high/medium), the specific line or pattern, why it’s a problem, and the fix with code example.

Common bugs by category:

Security Review Checklist

AI prompt for security review:

Review this code for security vulnerabilities. Code: [PASTE CODE]. Language: [LANGUAGE]. Framework: [IF APPLICABLE]. Check OWASP Top 10: (1) Injection — SQL, NoSQL, OS command, LDAP injection through unsanitized inputs, (2) Broken authentication — hardcoded credentials, weak token generation, missing session validation, (3) Sensitive data exposure — secrets in code, unencrypted data, verbose error messages leaking internals, (4) XSS — user input rendered without escaping, innerHTML usage, (5) Insecure deserialization — untrusted data deserialized without validation, (6) Components with known vulnerabilities — outdated dependencies, (7) Insufficient logging — security events not logged, (8) SSRF — user-controlled URLs in server-side requests. For each finding: severity, the vulnerable code, an attack scenario, and the secure alternative.

✅ Quick Check: AI flags this code: const token = Math.random().toString(36).substring(2). Why is this a security issue? (Answer: Math.random() is not cryptographically secure — it’s predictable. An attacker who knows the algorithm and seed can predict future tokens. For session tokens, API keys, or any security-sensitive random value, use crypto.randomBytes() in Node.js or secrets module in Python. AI catches this because it recognizes the pattern: Math.random() + security context = vulnerability.)

Performance Review Checklist

AI prompt for performance review:

Review this code for performance issues. Code: [PASTE CODE]. Context: [WHAT THIS CODE DOES, EXPECTED DATA VOLUME]. Check for: (1) N+1 queries — loops that execute database queries per item, (2) Unnecessary allocations — creating objects inside loops that could be created once, (3) Missing pagination — queries that could return unbounded result sets, (4) Synchronous blocking — I/O operations on the main thread, (5) Inefficient algorithms — O(n²) where O(n) or O(n log n) is possible, (6) Missing caching — repeated expensive computations with the same inputs, (7) Large payloads — returning more data than the consumer needs. For each finding: the performance impact (estimated time/memory), the current pattern, and the optimized alternative with code.

Review Comment Quality

AI prompt for review comment improvement:

Rewrite these code review comments to be more actionable and educational. Current comments: [LIST YOUR TYPICAL REVIEW COMMENTS]. For each comment, rewrite to include: (1) what’s wrong (specific, not vague), (2) why it matters (impact on reliability, security, or performance), (3) how to fix it (code example of the correct approach), (4) severity level (critical/important/suggestion/style). Transform vague comments like “this could be better” into specific, actionable feedback like “this function handles the happy path but doesn’t check for null return from getUser(). If the user ID doesn’t exist, this will throw a NullPointerException at line 42. Add: if (!user) return res.status(404).json({ error: ‘User not found’ }).”

Key Takeaways

• Happy-path coding is the most common source of production bugs — AI review systematically checks every failure mode (database errors, null results, type mismatches, timeouts) because it never forgets to ask “what happens if this fails?”
• AI security review should follow OWASP Top 10 categories for every PR: injection, authentication, data exposure, XSS, and SSRF are the most common web application vulnerabilities and the ones most often missed in human review
• AI review comments must be categorized by severity (critical/important/suggestion/style) — a flat list of 25 comments creates overwhelm, while a categorized list (3 critical, 5 important, 17 optional) feels manageable and focuses the developer on what matters
• Each review comment should include what’s wrong, why it matters, and how to fix it with a code example — “SQL injection vulnerability” is a flag; showing the attack scenario and the parameterized query fix is education
• Performance review should catch N+1 queries, missing pagination, and inefficient algorithms before they reach production — these are the issues that work fine in development (small data) and fail in production (large data)

Up Next

In the next lesson, you’ll learn to identify code smells — the patterns that indicate deeper design problems — and use AI to detect them at scale across your codebase.