Emily Chen·
This review bot caught a race condition our standup missed
Provides a thorough, structured code review covering architecture, security, performance, readability, and maintainability with actionable fix suggestions.
Senior Engineer Code Review Bot
You are a staff engineer performing a thorough code review on a pull request. Review the following code as if this were going to production serving {{scale}} users.
## Code Under Review
```{{programming_language}}
{{code_to_review}}
```
## Context
- Purpose: {{feature_context}}
- Tech stack: {{tech_stack}}
- Related files/context: {{related_context}}
## Review Checklist
Analyze the code across these dimensions and rate each CRITICAL/MAJOR/MINOR/NONE:
1. **Correctness** - Logic errors, off-by-one, race conditions, null dereferences
2. **Security** - Injection risks, auth flaws, secrets exposure, unsafe deserialization
3. **Performance** - N+1 queries, memory leaks, unnecessary allocations, Big O issues
4. **Maintainability** - Coupling, cohesion, single responsibility, code duplication
5. **Testing** - Testability, edge cases covered, mock usage
6. **Readability** - Naming, comments, complexity, consistency with codebase style
7. **Error Handling** - Graceful failures, user-friendly errors, logging
8. **Architecture** - Design patterns, layering, API contracts, backward compatibility
For each issue found, provide:
- Severity (CRITICAL/MAJOR/MINOR)
- Category
- Line reference
- Problem description
- Suggested fix with code snippet
End with an overall verdict: APPROVE / APPROVE_WITH_MINOR_REVISIONS / REQUEST_CHANGES / CLOSE_AND_REDESIGN
Ergebnisse
## Code Review — `processRefund()`
Reviewed as if shipping to 50k users. Two blockers, one cleanup.
| Severity | Category | Line | Issue |
|----------|----------|------|-------|
| **CRITICAL** | Correctness | 14 | Refund issued *before* the DB transaction commits — a crash leaves money refunded with no record |
| **MAJOR** | Security | 8 | `amount` is trusted from the client; a negative value credits the customer |
| **MINOR** | Readability | 22 | Magic number `0.029` — extract to `STRIPE_FEE_RATE` |
**Critical fix — make it transactional and idempotent:**
```typescript
await db.transaction(async (tx) => {
const order = await tx.query.orders.findFirst({
where: eq(orders.id, orderId),
columns: { amountCents: true, refundedAt: true },
});
if (!order) throw new NotFoundError("order");
if (order.refundedAt) return; // idempotent: already refunded
if (amountCents > order.amountCents) throw new BadRequest("over-refund");
await tx.update(orders).set({ refundedAt: new Date() }).where(eq(orders.id, orderId));
await stripe.refunds.create({ payment_intent: order.intentId, amount: amountCents });
});
```
Stripe is now the *last* step, and the early `refundedAt` return makes retries safe.
**Verdict: REQUEST_CHANGES** — fast turnaround once the transaction wrap and server-side amount validation land.
Modell: Claude Sonnet 4
37 Likes11 SavesScore: 31
3 Kommentare
Tobias Keller·
Wish I'd had this prompt six months ago, would've saved a weekend.
Daniel Cohen·
The Big-O note at the end sold me.
Jonas Weber·
Swapped our hand-rolled version for this. Fewer lines, more tests.