🔍 Code Review Best Practices

Reviewing code effectively to improve quality and share knowledge.

Reviewer mindset

• Be constructive, not critical
• Ask questions instead of making demands
• Focus on the code, not the author
• Approve when it's "good enough", not "perfect"

What to look for

Must check

• Correctness — Does it do what it's supposed to?
• Security — SQL injection, XSS, auth bypass, secrets in code?
• Edge cases — Null values, empty arrays, boundary conditions?
• Error handling — What happens when things fail?
• Tests — Are new behaviors tested?

Should check

• Readability — Can you understand it without the PR description?
• Naming — Are variables and functions well-named?
• Complexity — Is there a simpler approach?
• Performance — Any obvious N+1 queries or unnecessary loops?

Nice to check

• Consistency with codebase style
• Documentation for public APIs
• Commit message quality

PR author responsibilities

• Keep PRs small — under 400 lines ideally
• Write a clear description: what, why, how to test
• Self-review before requesting reviews
• Link to the ticket/issue
• Respond to all comments

Comment format

[nit] Optional style suggestion
[question] Why did you choose X over Y?
[suggestion] Consider using Z here because...
[blocking] This will cause a bug when...

Anti-patterns

• Rubber-stamping without reading
• Nitpicking style while missing logic bugs
• Blocking PRs for days
• Rewriting the author's code in comments