Code Review Checklist

• Does the code solve the problem it claims to solve?
• Are there any edge cases not covered by tests?
• Is error handling appropriate? Are failures handled gracefully?
• Are there any race conditions or concurrency issues?
• Does the code handle invalid or unexpected input?

# Good error handling
def withdraw(account, amount):
    if amount <= 0:
        raise ValueError("Amount must be positive")
    if amount > account.balance:
        raise InsufficientFunds(f"Balance: {account.balance}")
    account.balance -= amount
    return account.balance

Code Quality

Check for readability, maintainability, and adherence to project standards:

• Are variable and function names clear and descriptive?
• Is the code DRY (not duplicated)?
• Are functions small and focused on a single responsibility?
• Is there any commented-out or dead code?
• Are there any magic numbers or strings that should be constants?

Security

Security vulnerabilities in code reviews are cheap to fix. Look for:

• SQL injection risks (are queries parameterized?)
• Input validation on all user-facing data
• No hardcoded secrets, API keys, or credentials
• Proper authentication and authorization checks
• Sensitive data not logged or exposed in error messages

# Bad — vulnerable to SQL injection
query = f"SELECT * FROM users WHERE email = '{email}'"

# Good — parameterized query
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

Tests

• Are there tests for the new functionality?
• Do existing tests still pass?
• Are edge cases covered by tests?
• Are test names descriptive?

Conclusion

A code review is a conversation, not a gatekeeping exercise. Be kind, be specific, and always explain your reasoning. The goal isn't to find faults — it's to make the code and the team better together.