One search. Connected ideas.

A performance review checks whether the amount of work stays reasonable as input size and traffic increase. Database calls, large allocations and synchronous CPU work can be more important than small syntax choices. Use measurements for suspected hotspots rather than adding optimizations everywhere.

A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.

A useful review comment explains an observable problem, its consequence and a concrete improvement. It should be specific enough to act on while leaving room for the author to discuss constraints. Focus on behavior and evidence rather than criticizing who wrote the code or whether AI generated it.

React and async bugs often come from incorrect assumptions about identity, snapshots and completion order. A render's values can be captured by a callback, and asynchronous results may arrive after the UI has moved on. Review the lifecycle and timeline rather than checking syntax alone.

Correctness means the implementation satisfies the required behavior for valid, invalid and concurrent inputs. A review begins with the intended rule, because readable or compilable code can still implement the wrong rule. Trace the inputs, state changes and outputs before judging style.

Production failures often come from conditions absent in small examples: parallel requests, large datasets, expired credentials or unavailable providers. A review should consider how the code exposes and recovers from these conditions. Observability is part of the design because a hidden failure is harder to correct safely.

Reliability means the operation behaves predictably when dependencies fail, time out or return uncertain outcomes. It includes recovery after a crash, bounded resource use and preservation of business state. A happy-path test cannot prove that retries, rollback and cleanup are correct.

Maintainability means another developer can understand and safely change the code without discovering hidden dependencies. Clear responsibilities, names and contracts reduce the chance that a small change breaks unrelated behavior. Abstraction helps when it removes a real duplication or dependency, not merely when it adds more classes.

Edge cases are valid boundary conditions and failure situations that ordinary examples may not exercise. Useful tests prove important rules under those conditions, including concurrent and repeated requests. The highest-value case is often where a missing record, denied access or partial failure changes control flow.

A performance review checks whether the amount of work stays reasonable as input size and traffic increase. Database calls, large allocations and synchronous CPU work can be more important than small syntax choices. Use measurements for suspected hotspots rather than adding optimizations everywhere.

A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.

A useful review comment explains an observable problem, its consequence and a concrete improvement. It should be specific enough to act on while leaving room for the author to discuss constraints. Focus on behavior and evidence rather than criticizing who wrote the code or whether AI generated it.

React and async bugs often come from incorrect assumptions about identity, snapshots and completion order. A render's values can be captured by a callback, and asynchronous results may arrive after the UI has moved on. Review the lifecycle and timeline rather than checking syntax alone.

Correctness means the implementation satisfies the required behavior for valid, invalid and concurrent inputs. A review begins with the intended rule, because readable or compilable code can still implement the wrong rule. Trace the inputs, state changes and outputs before judging style.

Production failures often come from conditions absent in small examples: parallel requests, large datasets, expired credentials or unavailable providers. A review should consider how the code exposes and recovers from these conditions. Observability is part of the design because a hidden failure is harder to correct safely.

Reliability means the operation behaves predictably when dependencies fail, time out or return uncertain outcomes. It includes recovery after a crash, bounded resource use and preservation of business state. A happy-path test cannot prove that retries, rollback and cleanup are correct.

Maintainability means another developer can understand and safely change the code without discovering hidden dependencies. Clear responsibilities, names and contracts reduce the chance that a small change breaks unrelated behavior. Abstraction helps when it removes a real duplication or dependency, not merely when it adds more classes.

Edge cases are valid boundary conditions and failure situations that ordinary examples may not exercise. Useful tests prove important rules under those conditions, including concurrent and repeated requests. The highest-value case is often where a missing record, denied access or partial failure changes control flow.

Code review learning module