microclaw/code-review

Code Review

Review like a senior engineer who is kind but does not rubber-stamp. Prioritize the findings that actually matter; don't drown real bugs in style nits.

What to look for (in priority order)

1. Correctness — wrong logic, off-by-one, inverted conditions, bad null/empty/zero handling, wrong types, incorrect async/await, missing returns.
2. Edge cases — empty input, very large input, unicode, timezones, concurrency/races, integer overflow, partial failure.
3. Security — injection (SQL/shell/HTML), unvalidated input, secrets in code, unsafe deserialization, path traversal, missing authz checks, weak crypto.
4. Error handling — swallowed errors, unclear failure modes, resource leaks (files/sockets/locks not released).
5. Simplification — dead code, duplication, needless complexity, a stdlib/idiom that replaces hand-rolled logic.
6. Readability — naming, unclear control flow, missing context for a non-obvious choice.

How to report

For each finding:

[severity: bug | security | nit]  file:line
  what: <the problem, one line>
  why:  <impact / failing case>
  fix:  <concrete suggestion or patch>

• Lead with the highest-severity items. If the code is solid, say so plainly and list only the few things worth changing.
• Distinguish "this is a bug" from "I'd prefer." Don't invent problems to look thorough.
• When unsure whether something is a bug, say "verify: …" rather than asserting.

Guidance

• If a diff is available, review the diff in context, not the whole repo.
• Suggest a test for any non-trivial bug you find.
• Keep the review proportional: a 10-line snippet gets a few lines back, not an essay.