Finding security vulnerabilities , correctness bugs

Code Review Pro

Find the problems that matter, prove each one, and show the fix. A short list of real issues beats a long list of maybes.

Workflow

1. Set the scope. Decide what is under review: a pasted snippet, specific files, the working-tree diff (git diff, git diff --staged), or a branch against its base (git diff main...HEAD). For a diff, review the changed lines but read enough surrounding code to know how they are called.

2. Learn the context before judging. Identify language, framework and version (check package.json, pyproject.toml, go.mod, and so on), how the code is reached (HTTP handler, job, CLI, library), what input is untrusted, and any repo conventions (linters, CLAUDE.md, existing patterns). A pattern that is a bug in one framework can be safe in another; for example, React escapes JSX text, so XSS lives in dangerouslySetInnerHTML, href values, and raw HTML sinks.

3. Review in priority order, using references/checklist.md:

   1. Security
   2. Correctness and edge cases
   3. Performance
   4. Maintainability and conventions

4. Verify every finding before reporting it. For each candidate, trace the data flow: where does the input come from, can an attacker or real user control it, and does anything upstream already validate or escape it? Check whether a test covers it. If you can run code, reproduce the bug with a small test or script. Drop findings you cannot support; mark the rest with a confidence level.

5. Rank and write the report in the format below. Lead with the highest severity. Group repeated instances of one problem into a single finding with all locations.

Severity

• Critical - exploitable now or causes data loss/corruption: injection with user input, auth bypass, secrets in code, broken access control on real data.
• High - likely bug or vulnerability under realistic conditions: race on shared state, missing authorization check, unbounded query on a user-facing path, swallowed errors that hide failures.
• Medium - correct today but fragile: missing input validation behind a trusted caller, N+1 queries on small data, confusing ownership of state.
• Low - style, naming, small simplifications. Report at most a handful; skip anything a linter or formatter already enforces.

Output format

# Code Review: [scope]

**Verdict**: [Ship / Ship after fixes / Do not ship] - [one sentence why]
**Findings**: [n] critical, [n] high, [n] medium, [n] low

## Critical

### 1. SQL injection in user search (`src/api/users.ts:42`)
**Category**: A05:2025 Injection | **Confidence**: High
**Evidence**: `q` comes from `req.query` and is interpolated into the SQL string; no validation upstream.
**Impact**: Any caller can read or modify arbitrary tables.

Current:
```ts
const rows = await db.query(`SELECT * FROM users WHERE name LIKE '%${q}%'`);
```

Fix:
```ts
const rows = await db.query("SELECT * FROM users WHERE name LIKE $1", [`%${q}%`]);
```

## High
...

## Medium
...

## Low
- `utils/date.ts:10` - [one line]

## What is solid
[Two or three specific things done well, so the author knows what to keep.]

## Not reviewed
[Files, paths, or concerns outside scope or that could not be verified.]

Traps that cause bad reviews

• Reporting without reading the caller. "Missing validation" is often validated one layer up. Look before flagging.
• Generic advice. "Consider adding error handling" is not a finding. Name the failure: which call throws, what the user sees, what state is left behind.
• Style as severity. Line length, bracket placement, or personal preference never rank above Low.
• Outdated rules. Check against the version in use: useMemo/useCallback advice changes when the React Compiler is enabled, and many Node APIs now ship built-ins (fetch, crypto.randomUUID, node:test).
• Fixes that do not compile. Every "Fix" block must be valid for the language and version in the repo. If unsure, say so.
• Flooding. More than about 15 findings buries the critical ones. Summarize the long tail in one line.