Code Review Checklist

Exclusive to: reviewer agent

Validation Loop (MANDATORY)

Before completing any review, verify the codebase passes all checks:

composer test           # All PHP tests pass
npm run types          # No TypeScript errors
npm run lint           # No linting errors
./vendor/bin/pint --test  # PHP style OK

Report any failures as Critical findings.

Instructions

1. Review against project standards in docs/code-standards.md
2. Run through the checklist below
3. Report issues by severity (Critical → Warning → Suggestion)

Review Checklist

✅ Correctness

• Logic handles edge cases
• Error handling is appropriate
• Types are correct (no any unless justified)
• Tests cover new/changed behavior
• No dead code or unused imports

🔒 Security (OWASP)

• No secrets or credentials in code
• User input validated and sanitized
• Authorization checks in place
• No SQL injection (use Eloquent/query builder)
• No XSS (proper escaping, sanitization)
• CSRF protection enabled
• Rate limiting considered

⚡ Performance

• No N+1 queries (use eager loading: with())
• No unnecessary database calls
• Large datasets are paginated
• Indexes exist for filtered/joined columns

🧹 Maintainability

• Follows patterns in docs/code-standards.md
• Names are clear and consistent
• No unnecessary complexity
• DRY — no copy-paste duplication

🎨 Frontend

• Uses existing shadcn/ui components
• Loading and error states handled
• Accessible (keyboard, labels, contrast)
• Responsive (mobile + desktop)

📝 Documentation

• Code comments for non-obvious logic
• Docs updated if behavior changed
• Types documented with JSDoc if complex

Laravel Security Checks

React Security Checks

Severity Guide

Output Format

## 🔍 Review Summary
[One paragraph overview]

## 🚨 Critical (must fix)
1. [Issue]: [File:Line] — [Why critical]

## ⚠️ Warnings (should fix)
1. [Issue]: [File:Line] — [Recommendation]

## 💡 Suggestions (nice to have)
1. [Suggestion]: [File:Line] — [Improvement]

## ✅ What's Good
- [Positive observation]

Examples

• "Review this PR before merge"
• "Check this code for security issues"
• "Audit changes for performance"