AI Code Review Checklist

01 Before You Read Code

Check the PR shape, not the code

PR is under 400 lines — split larger PRs. Defect detection crashes above this threshold.Read the description first — understand why, then check if the how matches the intent.Check what's NOT in the diff — deleted tests? Removed error handling? Missing DB migration?Look at the file list before code — unexpected files = scope creep or accidental commits.Is there a test for the main change? — no test = no confidence it works beyond today.

02 Subtle Logic Bugs

1.75× more logic errors in AI-generated code (CodeRabbit)

Off-by-one in pagination — page * size vs (page - 1) * size. Fencepost error on last page.Stale closure in async — setState(count + 1) captures old value. Use setState(prev => prev + 1).Missing else branch — if (a) ... else if (b) ... — what if neither? Variable stays stale from previous iteration.Floating-point comparison — 0.1 + 0.2 === 0.3 is false. Use Math.abs(a - b) < epsilon.Timezone in date handling — new Date('2026-03-13') parses as local time without 'Z' suffix. Comparing dates across timezones shifts by hours.

03 AI-Generated Code Traps

AI handles the happy path, skips everything else

Hallucinated methods — AI invents obj.partnerId when schema has tenantId, or calls array.unique() which doesn't exist.async without await — function declared async but calls aren't awaited = unresolved promises, silent failures.Try-catch that swallows everything — catch(e) {} or just console.log(e) with no rethrow = ghost failures in production.Deprecated crypto — AI suggests md5() or sha1() for hashing. Copilot frequently generates insecure crypto patterns (Pearce et al.).Plausible but wrong regex — \d{4}-\d{2}-\d{2} matches "9999-99-99". Doesn't validate ranges or leap years.

04 Production Killers

These pass tests but break under real load

N+1 query in a loop — users.forEach(u => db.getOrders(u.id)) = 1000 users → 1001 DB queries.Retry without jitter — fixed-delay retries from all clients at once = thundering herd that DDoSes your own service.Connection leak — pool.get() without finally { conn.close() } = pool exhaustion under load.Cache key missing tenant ID — cache.get(`query_${partnerId}`) without tenant = data bleeds across accounts.DELETE/UPDATE without safe WHERE — always verify the WHERE clause scope. One wrong condition = wiped table.

05 What Reviewers Always Skip

The last 5 minutes of review catch the worst bugs

Error message content — does it leak stack traces, SQL queries, or internal file paths to the client?What happens on empty input? — empty array, null, undefined, empty string — not just "invalid" input.New dependency = new attack surface — check package age, maintainer count, downloads, known CVEs before approving.

The inverse test — tests prove "it works" but never test "it correctly rejects bad input".Rollback plan — if this PR breaks prod, can it be reverted cleanly? Or does it need data migration / manual cleanup?

01 Before You Read Code

Check the PR shape, not the code

02 Subtle Logic Bugs

1.75× more logic errors in AI-generated code (CodeRabbit)

03 AI-Generated Code Traps

AI handles the happy path, skips everything else

04 Production Killers

These pass tests but break under real load

05 What Reviewers Always Skip

The last 5 minutes of review catch the worst bugs

01 Before You Read Code

02 Subtle Logic Bugs

03 AI-Generated Code Traps

04 Production Killers

05 What Reviewers Always Skip

Want this as a team reference?

Get the AI Code Review Checklist

AI Code Review Checklist

01 Before You Read Code

02 Subtle Logic Bugs

03 AI-Generated Code Traps

04 Production Killers

05 What Reviewers Always Skip

Want this as a team reference?

Get the AI Code Review Checklist