whaojie797-design Code Review & Security
Overview
Perform thorough, opinionated pre-merge reviews and security audits. Apply a five-axis framework, classify findings by severity, and produce a consistent report so issues are actionable.
When to Use
- "review 代码", "代码审查", "审查这个 PR", "review this PR", "安全审计", "security audit", "code review".
- Before merging a feature, bugfix, or refactor.
- When the user wants a focused security pass.
Five-Axis Framework
- Correctness — Does it do what the spec says? Edge cases, off-by-one, null/empty, concurrency.
- Readability — Can another engineer understand it without explanation? Naming, structure, comments.
- Architecture — Follows existing patterns? Right abstraction level? No leaky boundaries.
- Security — Input validation, authz checks, secrets, injection, XSS, rate limiting, IDOR.
- Performance — N+1 queries, unbounded loops, missing pagination, needless allocations.
Severity Classification
- Critical — data loss, security vulnerability, broken functionality. Must fix before merge.
- Important — missing test, wrong abstraction, poor error handling. Should fix before merge.
- Suggestion — naming, style, optional optimization. Consider.
Procedure
- Read the diff / changed files fully; do not skim.
- Run each axis against the change; note
file:line — description + recommended fix. - Always note at least one thing done well.
- Emit the report using
references/review-template.md. - Include a verification story (tests run? build verified? security checked?).
Bundled Resources
references/review-template.md— copy-paste report skeleton.references/security-checklist.md— common vulnerability checks (OWASP-aligned).