Review Checklists: Verification Dimensions & Division of Labor
Actionable checklists across functionality, OWASP security, logging, and performance, with clear division between automated CI tools and human peer reviewers.
Categorized Verification: Systematic Coverage Without Reviewer Fatigue
Effective code reviews rely on structured verification dimensions rather than ad-hoc scanning. By offloading mechanical syntax, formatting, and known vulnerability patterns to automated CI tools, human reviewers can focus their cognitive energy on architectural fit, domain logic correctness, data boundary validation, and security threat models.
Division of Labor: Automated CI Tooling vs. Human Peer Review
What Automated CI Tools Check (Mechanical)
Zero human cognitive time spent on deterministic rules:
- Formatting & Style: Prettier / Black / gofmt enforcing indentation and line length
- Syntax & Static Lints: ESLint / Ruff / golangci-lint catching unused imports and anti-patterns
- Type Soundness: TypeScript
tsc --noEmitand MyPy typechecking - Known Vulnerabilities: SAST (SonarQube/Semgrep) and dependency CVE scanning (Snyk/Trivy)
- Automated Test Regression: Unit and integration test suite execution
What Human Reviewers Evaluate (Architectural)
High-value judgment and domain verification:
- Requirements Fulfillment: Does the logic satisfy clinical and business acceptance criteria?
- Architectural Consistency: Does the change follow established project patterns and ADRs?
- Boundary & Edge Cases: Are race conditions, unexpected nulls, and error branches handled?
- Security & Privacy Context: Are tenant boundaries, authorization checks, and PII sanitization sound?
- Maintainability & Simplicity: Is the code understandable to future engineers oncall?
Interactive Review Verification Matrix
Filter by verification dimension to inspect specific acceptance and regulatory criteria.
Requirements & Spec Alignment
Does the code accurately implement the specified acceptance criteria and handle all documented edge cases without scope creep?
Automated Test Verification
Are there unit and integration tests covering happy paths, negative error branches, boundary conditions, and null/undefined values?
Backward Compatibility & Migrations
Does the change maintain API and database schema backward compatibility, or provide zero-downtime expand-and-contract migration paths?
Input Validation & Parameterized Queries
Are all external user inputs strictly validated at the system boundary using runtime schemas (e.g., Zod) and parameterized SQL queries to eliminate injection vulnerabilities?
Authentication & Tenant Authorization
Does every protected route and mutation verify user session validity and enforce tenant-level resource isolation (preventing IDOR vulnerabilities)?
Zero Hardcoded Secrets & PII Scrubbing
Confirm zero API keys, private certificates, passwords, or raw ePHI/PII exist in code, commit history, or debug output logs.
Explicit Error Propagation (No Silent Catches)
Ensure catch blocks do not swallow exceptions silently. All errors must be handled gracefully with typed error boundaries and informative user messages.
Structured Audit & Diagnostic Logging
Are significant business mutations, authentication events, and authorization failures logged in structured JSON with correlation IDs and timestamps?
N+1 Query & Database Efficiency
Are database queries optimized with appropriate eager loading, indexed lookups, and connection pool timeouts to prevent resource starvation?
Non-Blocking Async & Resource Cleanup
Verify event listeners, file descriptors, database connections, and background timers are reliably released to prevent memory leaks.
Use this prompt to generate a custom review checklist tailored to your specific microservice architecture and data safety tier:
Community Discussion & Feedback
Attributed peer feedback and official Netspective architecture notes.