AI Prompts for Code Review

Review this [language] code comprehensively:
[code block]
Evaluate: 1) Bugs and logic errors (Critical). 2) Security vulnerabilities (Critical). 3) Performance issues (High). 4) Error handling gaps (High). 5) SOLID/DRY violations (Medium). 6) Naming and readability (Low).
Format each finding: Issue → Severity → Line(s) → Fix. End with an overall quality score (1–10) and the single most impactful change.

Perform a security-focused code review on this [language] code:
[code block]
Check against OWASP Top 10: injection (SQL/command/LDAP), broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialisation, known vulnerabilities, insufficient logging.
For each finding: vulnerability type, CWE ID, affected line(s), severity (Critical/High/Medium/Low), and a code-level remediation.

Review this [language] code for performance issues:
[code block]
Context: runs [how often] on inputs of size [scale].
Identify: inefficient algorithms (with Big-O analysis), unnecessary database queries (N+1), blocking I/O, memory waste, and missing caching opportunities. For each issue: current complexity → improved complexity → rewritten code snippet → estimated speedup.

Create a code review checklist for a PR that: [PR description].
Language: [language]. Team size: [size].
Checklist categories: Correctness (8 items), Tests (6 items), Security (5 items), Performance (4 items), Readability (5 items), Documentation (3 items), Breaking changes (4 items). For each item: what to check and a "how to verify" note.

Suggest refactoring improvements for this [language] code without changing its behaviour:
[code block]
Group suggestions by category: naming improvements, extract function opportunities, reduce nesting, eliminate duplication (DRY), improve data structures, and simplify conditionals.
For each suggestion: before → after code snippet + 1-sentence justification. Prioritise by impact-to-effort ratio.

Review the tests for this [language] function/module:
Code under test: [code]. Existing tests: [tests].
Identify: which cases are tested, which are missing (edge cases, error paths, boundary values), and whether the tests actually assert meaningful behaviour (not just that code runs). Write the 5 most important missing test cases.

Review this API design for usability and best practices:
Endpoints: [list endpoints with methods and descriptions]. Request/response schemas: [schemas].
Evaluate: REST principle adherence, URL naming conventions, HTTP method appropriateness, response status code usage, error response format, versioning strategy, authentication approach, and pagination design. Score each dimension and recommend the top 3 changes.

Review this database schema for correctness and scalability:
[schema definition]
Database: [DB type]. Expected data volume: [scale].
Check: normalisation level (appropriate for use case), index strategy, foreign key constraints, data type choices, nullable columns, naming conventions, and any N+1 query risks from the schema design. Recommend changes with migration impact notes.

Audit the dependencies in this project's [package.json/requirements.txt/Gemfile]:
[dependency file contents]
Flag: known security vulnerabilities (CVE references), outdated packages with major version gaps, unused dependencies (based on: [description of project]), duplicate functionality packages, and overly broad version constraints. Provide an upgrade priority list.

Review the architecture of this [system/service/module]:
Description: [describe the system]. Current structure: [file/component structure]. Scale: [current + expected].
Evaluate: separation of concerns, coupling and cohesion, scalability bottlenecks, single points of failure, testability, deployment complexity, and observability. Flag the top 3 architectural risks and recommend a migration path for the most critical.

Review this codebase for style consistency issues:
[code samples from different files]
Language: [language]. Style guide target: [e.g. PEP8/Airbnb/Google style guide].
List all inconsistencies found (naming, formatting, patterns). Recommend: which pattern to standardise on (with rationale), linter rules to enforce it, and the top 10 files to prioritise in a cleanup pass.

Review the error handling in this [language] code:
[code block]
Check: are all exceptions caught appropriately, are errors being silently swallowed, are error messages useful for debugging, is the caller notified correctly, is cleanup (finally/defer) handled, are retries implemented where appropriate, and are errors logged with enough context.
Rewrite the error handling for the most problematic section.

Review this [React/Vue/Svelte] component:
[component code]
Check: prop types and validation, state management approach, re-render performance (unnecessary renders), accessibility (ARIA, keyboard nav, contrast), event handler cleanup, side effect management (useEffect dependencies), and whether the component violates single responsibility. Suggest the top 3 improvements with code.

Review this [Terraform/CloudFormation/Ansible] configuration:
[IaC code]
Check: security group rules (least privilege), secret handling (no hardcoded credentials), resource naming conventions, tag strategy, idempotency, cost optimisation opportunities, backup and recovery provisions, and disaster recovery gaps. Flag any configuration that would cause a production incident.

Write a set of 15 professional code review comment templates for a team using [GitHub/GitLab/Bitbucket].
Include 3 comments for each category:
Blocking issue (must fix). Suggested improvement (non-blocking). Question / clarification needed. Positive feedback (acknowledge good work). Nitpick (style only).
Each template: the comment text + a note on when to use it. Constructive and respectful throughout.

Review this legacy [language] code that needs to be modernised:
[code block]
Estimated age/context: [when written + original purpose].
Identify: outdated patterns to replace, deprecated APIs or functions, missing tests that make refactoring risky, hidden business logic to document before changing, and a safe incremental refactoring plan (what to change first to reduce risk while improving quality).

Review the inter-service communication design for this microservices system:
Services: [list services]. Communication patterns used: [REST/gRPC/events/etc.]. Current pain points: [pain points].
Evaluate: synchronous vs async appropriateness, retry and circuit-breaker patterns, service discovery, distributed tracing hooks, and failure cascade risks. Recommend the top 3 resilience improvements.

Review this application configuration setup:
[config files or structure]
Check: secrets in config files, environment-specific overrides, hardcoded values that should be configurable, config validation on startup, documentation of each config key, and whether the config structure will scale as the team grows. Flag any production incident risks.

The following PR description is unclear or incomplete:
[PR title + description]
Rewrite it to include: a clear one-line summary, what changed and why (not just what), how to test the change (step-by-step), screenshots/recordings for UI changes, any breaking changes and migration steps, related tickets/issues, and a checklist of things the reviewer should verify. Keep it skimmable.

Design a code review process for a [team size]-person engineering team working on a [language/framework] codebase.
Current problem: [slow reviews/low quality/inconsistent standards/etc.].
Define: PR size limits, required reviewers (author can't approve own PRs), review SLA, what's blocking vs non-blocking, automated checks to run before human review, review comment etiquette guidelines, and how to handle disagreements.