Code Review Checklist

Code reviews are one of the most effective ways to improve code quality, share knowledge, and catch bugs before they reach production. But a review is only as good as the process behind it. Use this checklist to ensure thorough, constructive reviews.

Before You Start

A good review starts before you even look at the code. Set the right context:

Read the PR description and understand the goal
Check linked issues or tickets for requirements
Review recent commits for context on incremental changes
Ensure CI checks and automated tests have passed

Functionality and Logic

Verify the code works as intended and handles edge cases:

Does the code solve the problem it claims to solve?
Are there any edge cases not covered by tests?
Is error handling appropriate? Are failures handled gracefully?
Are there any race conditions or concurrency issues?
Does the code handle invalid or unexpected input?

# Good error handling
def withdraw(account, amount):
    if amount <= 0:
        raise ValueError("Amount must be positive")
    if amount > account.balance:
        raise InsufficientFunds(f"Balance: {account.balance}")
    account.balance -= amount
    return account.balance

Code Quality

Check for readability, maintainability, and adherence to project standards:

Are variable and function names clear and descriptive?
Is the code DRY (not duplicated)?
Are functions small and focused on a single responsibility?
Is there any commented-out or dead code?
Are there any magic numbers or strings that should be constants?

Security

Security vulnerabilities in code reviews are cheap to fix. Look for:

SQL injection risks (are queries parameterized?)
Input validation on all user-facing data
No hardcoded secrets, API keys, or credentials
Proper authentication and authorization checks
Sensitive data not logged or exposed in error messages

# Bad — vulnerable to SQL injection
query = f"SELECT * FROM users WHERE email = '{email}'"

# Good — parameterized query
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

Tests

Are there tests for the new functionality?
Do existing tests still pass?
Are edge cases covered by tests?
Are test names descriptive?

Conclusion

A code review is a conversation, not a gatekeeping exercise. Be kind, be specific, and always explain your reasoning. The goal isn't to find faults — it's to make the code and the team better together.

Code Review Checklist