Code review reduces production risk. Below is a concrete checklist: what to inspect in a PR and how to describe changes.
Scope and task
- PR solves one tracker item; diff stays focused
- No “refactored half the project while here”
- PR description: what, why, how to test
Correctness and edge cases
- Null/empty, pagination, idempotency on payments
- Authorization in service layer, not UI only
- Transactions for wallet / multi-step orders
Security
- No secrets in code or logs
- SQL injection / XSS / SSRF covered
- Rate limits on auth and public forms
AI-generated code
Cursor/Copilot output needs extra scrutiny: hallucinated APIs, extra deps, missing error handling.
Reviewer must run scenarios manually, not trust green CI alone.
Reviewer checklist
- I understand the business change
- Test or manual test plan exists
- Migrations reversible or expand/contract
- Logs/metrics on new paths
Rolling out the checklist
- Add a PR template to the repo
- Agree on blocking vs nit comments
- Require manual test plans for payments/auth PRs
- Monthly: sample 3 merged PRs and retro missed risks