Code Review
Get a Senior-Level Code Review
Review code for correctness, security, performance and readability with severity-ranked findings.
The Prompt
senior-level-code-review.md
You are a staff engineer reviewing a pull request. Be direct and specific. Stack: {{stack}} Purpose of this change: {{purpose}} Code: ``` {{code}} ``` Review in these categories, and skip any category with no real findings: 1. Correctness and edge cases 2. Security (injection, auth, secrets, unsafe input, dependency risk) 3. Performance and unnecessary work 4. Error handling and observability 5. API / naming / readability 6. Test coverage gaps For each finding: severity (blocker / major / minor / nit), the exact line or symbol, why it matters, and the concrete change to make. End with the 3 changes I should make before merging, and what is fine as-is. Do not invent problems to fill space.
Negative prompt
Included when you copy the prompt
Do not invent problems to fill every category. Do not nitpick naming or style when there is no correctness, security, or clarity issue. Do not recommend a full rewrite when a targeted fix would work. Do not flag hypothetical issues that cannot occur with the shown code and stack. Do not ignore security findings in favour of cosmetic comments. Do not give vague advice like "add more tests" without naming the missing case.
Fill in your details below - this prompt updates as you type, then copy it.
Fill in your details
0 of 3 filled. Preview updates as you type - then copy the finished prompt (negative prompt included when present).
senior-level-code-review.md
Prompt preview
You are a staff engineer reviewing a pull request. Be direct and specific. Stack: {{stack}} Purpose of this change: {{purpose}} Code: ``` {{code}} ``` Review in these categories, and skip any category with no real findings: 1. Correctness and edge cases 2. Security (injection, auth, secrets, unsafe input, dependency risk) 3. Performance and unnecessary work 4. Error handling and observability 5. API / naming / readability 6. Test coverage gaps For each finding: severity (blocker / major / minor / nit), the exact line or symbol, why it matters, and the concrete change to make. End with the 3 changes I should make before merging, and what is fine as-is. Do not invent problems to fill space.
Examples
Example input
Stack: Node 20 + Express + PostgreSQL (pg) Purpose: Add POST /api/orders that creates an order for the authenticated user. Code: app.post("/api/orders", async (req, res) => { const { items, coupon } = req.body; const total = items.reduce((s, i) => s + i.price * i.qty, 0); const discount = coupon === "SAVE10" ? total * 0.1 : 0; const id = await db.query( `INSERT INTO orders (user_id, total, items) VALUES ('${req.user.id}', ${total - discount}, '${JSON.stringify(items)}') RETURNING id` ); res.json({ id: id.rows[0].id, total: total - discount }); });
What you should get
**Security - blocker:** String-interpolated SQL and JSON in VALUES. Use parameterized query ($1, $2, $3). Risk: SQL injection via items/coupon path and broken escaping. **Correctness - major:** Trusting client-supplied i.price. Load prices from the catalog by SKU/id server-side before computing total. **Correctness - major:** No validation that items is a non-empty array with positive qty integers. **Error handling - minor:** No try/catch; DB failures become an unhandled rejection. Return 500 with a stable error shape and log the cause. **Fine as-is:** Route shape and returning { id, total } once inputs are trusted. **Before merge:** (1) parameterized INSERT, (2) server-side price lookup, (3) input validation + auth check that req.user exists.
How to get a good result
Done when
**Security - blocker:** String-interpolated SQL and JSON in VALUES. Use parameterized query ($1, $2, $3). Risk: SQL injection via items/coupon path and broken escaping. **Correctness - major:** Trusting client-supplied i.price. Load prices from the catalog by SKU/id server-side before computing total. **Correctness - major:** No validation that items is a non-empty array with positive qty integers. **Error handling - minor:** No try/catch; DB failures become an unhandled rejection. Return 500 with a stable error shape and log the cause. **Fine as-is:** Route shape and returning { id, total } once inputs are trusted. **Before merge:** (1) parameterized INSERT, (2) server-side price lookup, (3) input validation + auth check that req.user exists.
FAQ
- What do I fill in before I copy this prompt?
- Replace these placeholders with your details: stack, purpose, code. Required fields are marked on the page. The prompt text updates as you type.
- Which AI tools is this prompt written for?
- It works best with ChatGPT, Claude, Cursor. Copy the filled prompt and paste it into the tool you already use.
- What should a good result look like?
- **Security - blocker:** String-interpolated SQL and JSON in VALUES. Use parameterized query ($1, $2, $3). Risk: SQL injection via items/coupon path and broken escaping. **Correctness - major:** Trusting client-supplied i.price. Load prices from the catalog by SKU/id server-side before computing total. **Correctness - major:** No validation that items is a non-empty array with positive qty integers. **Error handling - minor:** No try/catch; DB failures become an unhandled rejection. Return …
Best for
- Developers
- Tech leads
- Freelancers
Related Prompts
More prompts like this — same topic and style.
