Conduct Systematic Code Reviews with Quality Checklist

Code Review Checklist organizes a review around the problem being solved and the evidence needed to assess the change. It starts with requirements, changed files, related issues, and the testing strategy, then examines functionality, code quality, security, performance, and tests. The checklist can also support code audits, team review standards, reviewer training, and review documentation.

Functionality checks include acceptance criteria, edge cases, input validation, logical conditions, terminating loops, recursion base cases, state handling, and appropriate errors. Error messages should be useful without exposing sensitive information, failed operations should be rolled back appropriately, and logging should suit the failure being diagnosed.

Use it while reviewing a pull request or developing a consistent review process. Smaller changes make thorough review easier. Understand the context, check test evidence, run the code where possible, and ask specific questions when requirements or behavior are unclear. Feedback should identify consequential issues and proposed improvements while remaining constructive.

Do not tick checks that were not observed or tested. Scanner silence does not prove that vulnerabilities are absent, and the checklist is not a substitute for environment-specific testing or expert review. The separated-concerns order example illustrates structure only: real payment, inventory, and email operations require awaited failures, idempotency, and a transaction, outbox, or compensation strategy.

Inputs include the change, its description, linked issues, project conventions, and test results. The resulting review records inspected behavior, unavailable evidence, questions, and requested changes. Comment templates pair an issue with current code, a suggested fix, and the reason for the recommendation. Question templates add context and an optional suggestion.

Security inspection covers validated inputs, parameterized queries, escaped output, CSRF protection, upload checks, authentication, authorization, password hashing, sessions, expiring tokens, protected data, secret handling, and dependency risks. One parameterized-query example is:

const query = 'SELECT * FROM users WHERE email = $1';
db.query(query, [email]);

Quality checks examine naming, focused functions, separation of concerns, duplication, dead code, compatibility, breaking-change documentation, and technical debt. Performance checks look for unnecessary loops or queries, N+1 access, memory leaks, inefficient algorithms, and unsuitable caching. Test review considers meaningful new-code coverage, edge cases, errors, and passing results. Documentation and Git checks cover updated API guidance, migration instructions where needed, clear commits, conflicts, branch freshness, and unnecessary files.

Linters, formatters, and security scanners support the review. The guidance names npm audit, Snyk, and OWASP Top 10 as resources for security checks. Related workflows address requesting and receiving reviews, systematic debugging, and test-driven development.