code-review-checklist

Pre-Review

• [ ] Understand the purpose of the change
• [ ] Check scope — one logical change or several bundled?

Correctness

• [ ] Logic is correct, edge cases handled (None, empty, boundary)
• [ ] Exceptions caught specifically, not bare except:
• [ ] Async operations awaited, resources closed properly
• [ ] Database queries use correct indexes

Security

• [ ] User input validated at boundaries
• [ ] SQL uses parameterized queries, not string formatting
• [ ] No eval(), exec(), pickle.loads() on untrusted data
• [ ] No subprocess with shell=True and unsanitized input
• [ ] Secrets in environment variables, not in code
• [ ] Sensitive data excluded from logs

Performance

• [ ] No N+1 database queries
• [ ] Expensive operations cached where appropriate
• [ ] Large datasets streamed, not loaded entirely into memory
• [ ] New dependencies justified

Code Quality

• [ ] Type hints on all function signatures
• [ ] Docstrings on public functions and classes (Google style)
• [ ] No mutable default arguments
• [ ] No print() — uses logging
• [ ] Functions under 30 lines, single responsibility
• [ ] No unused imports or wildcard imports
• [ ] Magic numbers replaced with named constants

Testing

• [ ] Tests exist for new functionality
• [ ] Tests cover happy path and error cases
• [ ] Tests are deterministic (no network, no timing)
• [ ] Existing tests still pass

Architecture

• [ ] Follows existing patterns in the codebase
• [ ] No circular imports
• [ ] Change is in the right layer

When to Use

Load this skill when performing or preparing code reviews.