Code Review Prompt — the Review Contract
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Allocations in hot loops, N+1 queries, complexity against real input sizes — the performance review that thinks about production load.
Performance problems hide from functional review: the code works, the tests pass, and the N+1 query ships. This setup runs the performance focus — ten checks covering hot-loop allocations, queries inside loops, implied missing indexes, algorithmic complexity at realistic sizes, blocking I/O, cache invalidation, premature materialization, pagination, and resource leaks — demonstrated on a Python data-processing service, where the language mode adds Python's own traps: mutable defaults, broad excepts, GIL-blocking async.
State the load in the objective
"Under production load" anchors the review — complexity findings need a size to be judged against.
Prioritize the database findings
N+1 and missing-index findings usually dominate everything else in real systems.
Measure before fixing MINORs
CRITICAL and MAJOR performance findings justify work; MINOR ones justify a profiler run first.
It reports only. The template states "Review only — report findings; do not rewrite the code," so checklist item 2 (N+1 patterns or database calls inside loops) surfaces the suspect with its severity tag and location. The code-review-prompt-generator outputs this review prompt; you run it in your assistant, then decide and apply fixes yourself.
The language is set to Python, so checklist items 11-14 ride along: mutable default arguments, bare or overly broad except clauses, CPU-bound work blocking async, and f-string or %-built SQL instead of parameters. To review another language, regenerate in the code-review-prompt-generator with that language set so the traps change to match.
The objective anchors it to "production load," and checklist item 4 judges algorithmic complexity against realistic input sizes rather than toy inputs. The prompt still measures nothing: notFor states "Profiling — the review finds suspects; measurement convicts them," so a flagged finding justifies running a profiler, not a code change on faith.
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.
Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.
"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.
getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.
A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.
Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.
Ask AI to "review this for performance" and you get a tidy list of smells with no idea which one production actually spends time on. Here is how to review code for performance with AI so each finding is tied to a workload, ranked by evidence, and marked with the measurement that would confirm it.