Prompt Engineering

Code Review Prompt — the Review Contract

"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.

Open in Code Review Prompt Generator

Overview

The difference between a useless AI review and a useful one is the contract: what to look for, how to report it, and what verdict to end with. This setup loads the baseline contract — a correctness review of a complete file with the twelve-check correctness checklist, the four-level severity standard ([CRITICAL] through [NIT], severity reflecting impact not effort), findings-only output with exact locations, and a verdict rule. It's the template every other review on this site specializes from.

How to use this resource

Generate once, reuse per review

The contract is the standard; paste each file or diff into the code slot and every review comes back in the same shape.
Read findings by severity

CRITICAL first — the grouping rule means the things that block merge are always at the top.
Hold the AI to the verdict rule

"Base the verdict only on the findings listed" — no vibes-based approvals.

Why This Works

A checklist the AI must work through beats an open-ended "look for problems"
Severity tagging turns prose into a triageable review
Findings-only output cuts the praise padding that hides real issues

Best for

Developers using chat AIs as a second reviewer
Teams that want review consistency across members and models
Anyone tired of "looks good, consider adding comments" reviews

Not for

Making the AI rewrite the code — that's the Refactor Prompt Builder (review judges, refactor changes)
A persistent reviewer persona — that's a System Prompt (SPG); this is a per-review task contract

Use cases

Getting findings with severities instead of vague observations
Standardizing what every AI review must check and report
Ending every review with a defensible verdict

FAQ

How does the AI code review prompt decide a finding's severity?

Each finding gets exactly one tag, [CRITICAL], [MAJOR], [MINOR], or [NIT], and the SEVERITY RULES specify that severity reflects impact, not effort to fix: CRITICAL means bugs, vulnerabilities, or data loss that must be fixed before merge. Findings group CRITICAL-first. The code-review-prompt-generator produces this contract; you paste it into your own assistant and still validate each finding yourself.

Will this prompt rewrite my code or just review it?

Review only. The REVIEW OBJECTIVE states "report findings; do not rewrite the code", and the output is findings-only with an exact line, function, or symbol cited for each. It ends with a FINAL VERDICT (APPROVED, APPROVED WITH COMMENTS, or CHANGES REQUIRED) based only on the listed findings. The notFor routes actual rewrites to the Refactor Prompt Builder.

What does the twelve-item checklist force the AI to actually verify?

It walks twelve concrete items: boundary input validation, edge cases (empty, zero, negative, maximum), off-by-one errors, null handling before dereference, propagated vs swallowed errors, awaited async, race conditions, checked return values, intentional coercions, comparison boundaries (< vs <=), dead code, and whether the code does what its name claims. The generator writes it; only failing items get reported, and you confirm each against your file.

Customize This Resource

Opens this setup in Code Review Prompt Generator. Generate to get the full review contract — then adjust the focus, scope, language, and style.

Open in Code Review Prompt Generator

Prompt Template

Copy it as-is, or use Open in Code Review Prompt Generator to load it pre-filled and customize it with your own context.

REVIEW OBJECTIVE
Review this module against the team's review standard before merge.
Primary focus: correctness — find the ways this code produces wrong results or fails.
Review only — report findings; do not rewrite the code.

REVIEW SCOPE
You are reviewing a complete file — judge both the code and the file's structure: imports, ordering, and what this file owns.

REVIEW CRITERIA
- Logic errors and inverted conditions
- Edge cases: empty, zero, negative, maximum, duplicate inputs
- Null/undefined/None handling before dereference
- Error paths: propagation, swallowed exceptions, partial failure states
- Concurrency: race conditions, unawaited async results, shared mutable state

SEVERITY RULES
- Tag every finding with exactly one severity: [CRITICAL], [MAJOR], [MINOR], or [NIT].
- CRITICAL: must be fixed before merge — bugs, vulnerabilities, data loss.
- MAJOR: should be fixed — real risk or real debt.
- MINOR: worth fixing — small risk or friction.
- NIT: style preference; fixing is optional.
- Severity reflects impact, not effort to fix.

REVIEW CHECKLIST
Work through every item; report only the items that fail:
1. Are inputs validated at the boundaries where they enter?
2. Are edge cases handled: empty, zero, negative, maximum-size inputs?
3. Any off-by-one errors in loops, slices, or range checks?
4. Is null/undefined handled before every dereference?
5. Do error paths return or propagate correctly — nothing swallowed silently?
6. Are async operations actually awaited and their failures handled?
7. Any race conditions on shared state or check-then-act sequences?
8. Are return values of fallible calls checked?
9. Are type coercions and implicit conversions intentional?
10. Are comparison boundaries correct (< vs <=, exclusive vs inclusive)?
11. Is there dead or unreachable code hiding an intent mismatch?
12. Does the code do what its name and comments claim it does?

REQUIRED OUTPUT FORMAT
- One finding per bullet: [SEVERITY] location — what is wrong and why it matters.
- Group findings by severity, CRITICAL first.
- Cite the exact line, function, or symbol for every finding.
- Do not mention checklist items that pass — findings only.
- Prioritize findings that matter; skip pure style nits unless they hurt readability.
- If something is done notably well, say so once — briefly.

FINAL VERDICT
- End with a verdict: APPROVED, APPROVED WITH COMMENTS, or CHANGES REQUIRED.
- Base the verdict only on the findings listed above.

CODE TO REVIEW
[Paste the file here]

More resources from Code Review Prompt Generator

Resource

Security Code Review Prompt

Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.

Engineering

Resource

API Review Checklist Prompt

Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.

Engineering

Resource

Authorization Review Prompt

Hunt the broken-access-control bug — review code for missing per-resource checks, IDOR, and 'logged in' mistaken for 'allowed', the vulnerability class that tops the OWASP list.

Engineering

Resources that pair well

Resource

Refactor Prompt — the Behavior Preservation Contract

"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.

Prompt Engineering

Resource

Playwright Test Prompt

getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.

Engineering

Resource

Compare Two ChatGPT Prompts

A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.

Prompt Engineering

Related tools

Tool

Code Review Prompt Generator

Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.

Coding Workflows

Projects that use this resource

Project

Build a SaaS MVP with AI

The full path from idea to a shipped SaaS MVP — define and scope the requirements, design the architecture, API, and data model, then build it reviewed, tested, secured, cost-controlled, and deployed.

11 stages Product Build

Project

Build an API Backend with AI

The full path to a backend you can put clients on — define the requirements, design the architecture, API contract, data model, and access control, then build it reviewed, tested, secured, and shipped.

9 stages Software Development

Project

Modernize a Legacy Codebase with AI

The full path to taming an inherited codebase — understand it, document its architecture, pin its behavior with tests, then refactor, modernize, review, speed up, and ship it without breaking what works.

8 stages Software Development

Workflows that use this resource

Workflow

AI Code Review Workflow

A complete AI-assisted review pass — not one prompt — that ends with ranked findings, tests guarding behavior, and a refactor plan when one is warranted.

5 steps 30–45 minutes

Workflow

AI Code Refactoring Workflow

Restructure code you own without breaking it — change only what's worth changing, and prove with tests and a diff that behavior held.

4 steps 30–60 minutes

Workflow

AI Test Generation Workflow

Build a test suite that fails for real reasons, not green decoration — coverage across unit, integration, and edge cases, then a review for the gaps.

5 steps 30–60 minutes

Workflow

AI UI & Component Design Workflow

Structure a UI so it stays consistent as it grows — inventory the screens, break them into reusable components, specify the component system and its rules, then review the structure for drift.

4 steps 40–70 minutes

Tip: Save time by exploring related resources and tools that integrate with this resource.