Claude for Code Review

Claude for Code Review: AI-Assisted Code Quality

AI code review is one of the highest-value applications of language models for developers. A thorough code review that might take a senior engineer an hour can be completed in seconds — catching bugs, security issues, and code quality problems before they reach production.

Why Claude for Code Review

Claude (Anthropic) is particularly well-suited for code review because:

• Long context window (200K tokens) — can review entire files or multiple related files together
• Nuanced reasoning — explains why something is a problem, not just that it is
• Conservative on security — more likely to flag potential issues than dismiss them
• Codebase-aware — understands relationships between components when given context

The Systematic Code Review Prompt

Don't ask for "a code review" — be specific about what you want checked:

Review this code for production readiness. Check each category and be specific:

1. **Bugs and logic errors**
   - Any code paths that would produce incorrect results?
   - Off-by-one errors or boundary conditions?
   - Race conditions or concurrency issues?

2. **Security vulnerabilities**
   - SQL injection, XSS, CSRF vulnerabilities?
   - Improper authentication/authorization checks?
   - Sensitive data exposure (logging credentials, exposing internals in error messages)?
   - Input validation gaps?

3. **Error handling**
   - Unhandled promise rejections?
   - Errors that would crash the process vs. graceful failures?
   - Error messages that expose internal implementation?

4. **Performance**
   - N+1 query problems?
   - Unnecessary computation in loops?
   - Missing database indexes based on query patterns?

5. **Code quality**
   - Any code that would be confusing for the next developer?
   - Functions doing too much (violating single responsibility)?
   - Naming that doesn't accurately describe behavior?

6. **TypeScript (if applicable)**
   - Missing or overly broad types?
   - Any usage of `any` that undermines type safety?

[Paste code]

Security-Focused Review

Security vulnerabilities deserve their own review pass:

Perform a security review of this code. Focus specifically on:

**Injection vulnerabilities:**
- SQL injection (even with ORMs — check raw queries)
- Command injection if using child_process
- Template injection

**Authentication and authorization:**
- Are all protected routes actually checking authentication?
- Are authorization checks happening at the right layer (not just the UI)?
- Is there any privilege escalation risk?

**Data exposure:**
- What does an API response expose that it shouldn't?
- Are error messages leaking implementation details?
- Is any sensitive data logged?

**Input handling:**
- Is user input validated before use?
- Is output encoded properly (XSS prevention)?
- Is there any path traversal risk?

**Dependencies:**
- Any obviously dangerous patterns based on how libraries are used?

[Code]

Context: This is a [public API / internal API / user-facing app] 
handling [describe data sensitivity].

Reviewing Database Access Patterns

Review these database queries and data access patterns:

[Paste Prisma queries, SQL, or ORM code]

Check for:
1. N+1 queries — any relationship that's being queried in a loop?
2. Missing transaction usage where multiple operations need to be atomic
3. Queries that don't scale — what happens with 1 million records?
4. Missing indexes — based on how data is filtered and sorted, what indexes are needed?
5. Race conditions — any read-modify-write patterns that need locking?
6. Connection handling — is the connection pool being managed correctly for serverless?

API and Interface Review

Review this API design and implementation:

[Paste API routes/handlers]

Check:
1. Is the HTTP method semantic (GET for reads, POST for creates, etc.)?
2. Are responses consistent (same error format everywhere)?
3. Is there proper input validation before processing?
4. Are status codes correct (201 for creates, 204 for deletes, etc.)?
5. Is the API idempotent where it should be?
6. Rate limiting — is there protection against abuse?
7. Authentication — is every endpoint that needs auth protected?
8. What happens with malformed input, missing fields, or oversized payloads?

Reviewing Pull Requests

For reviewing a complete PR:

I'm reviewing a pull request. Here's the diff:

[Paste git diff]

Context:
- This is adding [describe feature]
- It touches [describe what parts of the system]

Review for:
1. Does this implementation match what the PR description claims?
2. What's missing that should be here?
3. What edge cases aren't handled?
4. What tests are missing?
5. Any breaking changes that aren't documented?
6. Anything that will be a maintenance burden later?

Give me specific, actionable feedback I can put in PR comments.

Incremental Review During Development

You don't have to wait until you're done to get a review:

I'm working on this feature. Here's what I have so far:
[paste work in progress]

I'm about to implement [next step].
Before I do: is there anything in what I've written so far that I should 
fix before going further? Any design decisions that will make the next step harder?

Catching architectural issues before you've built on top of them is far less painful.

Using Claude Code (CLI) for Review

Claude Code (the CLI tool) has advantages for code review that the web interface doesn't:

# Review the current git diff
claude "Review the changes in this PR. Focus on security and correctness."

# Review a specific file with full codebase context
claude "Review src/lib/auth.ts for security vulnerabilities. 
Consider how it integrates with the middleware and API routes."

Because Claude Code can read your actual files, it has the full codebase context — not just what you paste into a browser.

Creating a Review Checklist for Your Stack

Save a custom review checklist for your tech stack:

Create a code review checklist for our stack:
- Next.js App Router with TypeScript
- Prisma + PostgreSQL
- NextAuth.js for authentication
- Tailwind CSS

What should every code review check for in this specific tech stack?
Include things that are specific to Next.js 14 App Router (common mistakes, 
gotchas with Server Components, etc.) and Prisma (common N+1 patterns, etc.)

The Limits of AI Code Review

AI review doesn't replace human review:

• Business logic correctness requires understanding the business
• Architectural decisions require context about the whole system
• Team convention enforcement requires knowing your team's specific decisions

AI may miss:

• Subtle logic errors in complex algorithms
• Security issues specific to your deployment environment
• Interactions between components it doesn't have context on

AI may over-flag:

• Intentional design choices that look unusual without context
• Patterns that are correct for your specific use case
• Third-party library usage that's valid but not well-known

Use AI code review as a first pass that catches mechanical issues — then apply human judgment for design and business logic.

Next lesson: Make automation guide — building powerful automated workflows with AI.