code-review

Review code changes in a TypeScript/Next.js stack for quality, security, and correctness.

Workflow

1. Read the diff — use git diff --stat for overview, then read changed files
2. Check each category against the checklist below
3. Compile findings using the severity format
4. Present summary — total counts per severity, then details grouped by file
5. Verdict — state whether the PR is ready to merge or needs changes

Checklist

Category	What to check
Type safety	No any, proper generics, correct nullability, exhaustive switch
Error handling	try/catch with typed errors, no silent failures, user-facing error messages
Security	Input validation, SQL injection via raw queries, XSS in dangerouslySetInnerHTML, auth checks on protected routes
Performance	N+1 queries, unnecessary re-renders (missing memo/useMemo), missing DB indexes on filtered columns
Patterns	Consistent with existing codebase conventions (naming, file structure, API response shape)
Tests	New code paths covered, edge cases (null, empty, boundary), error conditions

Severity format

🔴 Critical — [file:line] description (must fix before merge)
🟡 Suggestion — [file:line] description (improves quality)
🟢 Nice — [file:line] description (optional polish)

Example

🔴 Critical — src/api/users.ts:42 Raw SQL interpolation creates injection risk. Use parameterized query.
🟡 Suggestion — src/components/Dashboard.tsx:15 Large object recalculated every render. Wrap in useMemo.
🟢 Nice — src/utils/format.ts:8 Could use template literal for readability.

Memory

After each review, note recurring issues specific to this project (e.g., "API handlers in this repo often miss auth middleware") to improve future reviews.