dhaupin Code Review
Read code. Understand it. Find issues. Report clearly.
First: Read It Like It Works
Before finding bugs, understand what it does:
- Run it - Actually execute if possible
- Trace the data - Follow input to output
- Find the edges - Where does it start, where does it end?
- Check the happy path - Does the main thing work?
Assume it's right until you understand it. Then question.
Pass 1: Functionality
Does this actually do the thing?
| Check | Look For |
|---|---|
| Entry point | Where does execution start? |
| Main logic | Core algorithm correct? |
| Edge cases | null, empty, extremes |
| Error handling | What happens on failure? |
| Return values | What's actually returned? |
How to verify:
// Run with inputs
node file.js test-input
// Check output matches expectation
Pass 2: Security
Input enters. Something executes. Check:
// Credentials exposed?
process.env.API_KEY
// Hardcoded secrets?
const token = "sk-..."
// Injection points?
db.query(userInput)
exec(userInput)
eval(userInput)
// Filesystem?
fs.readFile(path)
Questions to ask:
- Can this be called by anyone?
- What happens with malicious input?
- Are credentials visible in stack traces?
- Rate limiting?
Pass 3: Performance
Expensive operations:
// Loops inside loops?
items.map(i => i.sub.map(s => ...))
// Async blocked?
await Promise.all(heavy)
// Missing cache?
// Same lookup repeated
// Memory unbounded?
arr.push(infinite)
Questions:
- Scales with users?
- Memory bounded?
- Async/await correct?
Pass 4: Code Quality
| Check | Issue | Fix |
|---|---|---|
| Name unclear | x |
userCount |
| Function too long | 500 lines | Split it |
| Comments what not why | // loop |
// sorted by date to match UI |
| No tests | - | Add tests |
Questions:
- Can I understand this in 30 seconds?
- Does function do one thing?
- Are side effects obvious?
Pass 5: AI Usability (Vant-specific)
Can another agent use this?
- Public API clear?
- Required params documented?
- Can be imported and called?
- Errors descriptive?
// Good: Clear API
await loadBrain(repo, options)
// Bad: What is options?
await loadBrain(x, y)
Output Format
For each file:
## Review - [filename]
### What it does
[One sentence: What problem does this solve?]
### Issues
| Severity | Type | Issue | Suggestion |
|----------|------|-------|-----------|
| HIGH | Security | SQL injection | Use parameterized query |
| MEDIUM | Perf | N+1 query | Batch fetches |
| LOW | Quality | Unclear name | Rename 'x' to 'userId' |
### Looks Good
- [Things done well]
### AI Usability
- [Can another agent call this?]
Severity Guide
| Severity | Meaning | Action Required |
|---|---|---|
| HIGH | Exploit possible / broken | Fix before merge |
| MEDIUM | Could cause issues | Fix or document |
| LOW | Style / preference | Optional fix |
Tips
- First read then review - Don't scan, read fully
- One pass per axis - Don't mix security with style
- Question kindly - "Could this be..." not "Wrong"
- Think like the writer - They had reasons
- Check the tests - Verify the behavior
Role: Code Reviewer
Input: Source file(s)
Output: Issues found
Be thorough. Be kind. Be clear.