Resource
Code Review Prompt — the Review Contract
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Code Review Prompt Generator resources
Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.
Resource
Security Code Review Prompt
Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.
Resource
API Review Checklist Prompt
Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.
Resource
Authorization Review Prompt
Hunt the broken-access-control bug — review code for missing per-resource checks, IDOR, and 'logged in' mistaken for 'allowed', the vulnerability class that tops the OWASP list.
Resource
JWT Security Review Prompt
Review JWT usage for the known traps — alg confusion, missing signature/expiry checks, secrets in the token, and the revocation problem stateless tokens create.
Resource
Legacy Code Review Prompt
Mentoring-style maintainability review: what makes the next change expensive, explained with corrected examples — teach, don't just judge.
Resource
Performance Code Review Prompt
Allocations in hot loops, N+1 queries, complexity against real input sizes — the performance review that thinks about production load.
Resource
Privilege Escalation Audit Prompt
Find the path from user to admin — audit for vertical and horizontal escalation: mass-assignment of roles, unchecked elevation, and operations that trust client-supplied privilege.
Resource
Production Readiness Review Prompt
SHIP or DO NOT SHIP: twelve checks on failure modes, observability, rollback, and load — the review that happens before the incident.
Resource
Pull Request Review Prompt
Review the change as it will land: cross-file impact, deployment risk, migration safety — plus whether the PR does what its description says.
Resource
Review AI-Generated Code
AI wrote it; review it with extra suspicion: strict correctness review of the diff, because generated code fails confidently.
Resource
Review C# Code with AI
Correctness review with C#'s own traps: async deadlocks, undisposed IDisposables, double-enumerated LINQ, silenced nullability.
Resource
Review JavaScript Code with AI
Best-practices review with JavaScript's own traps added: equality coercion, floating promises, this-binding, shared-object mutation.
Resource
Session Management Review Prompt
Review the session lifecycle for the classic holes — fixation, weak expiry, missing rotation, insecure cookies, and sessions that outlive a logout or password change.