Code Review Prompt — the Review Contract
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Correctness review with C#'s own traps: async deadlocks, undisposed IDisposables, double-enumerated LINQ, silenced nullability.
C# correctness has language-shaped corners: a .Result on a task deadlocks under a synchronization context, an undisposed connection leaks until the pool starves, a LINQ query enumerates twice and doubles its cost, a ! suppresses the nullability warning that was right. This setup runs the twelve-check correctness review with the C# language pack covering exactly those four, under Strict style — every finding flagged, APPROVED or CHANGES REQUIRED — tuned for the hotfix that has to be right the first time.
Run on the changed class, full file
Async and disposal problems live in the relationships between methods — snippet scope hides them.
Trust the async findings
Sync-over-async findings are CRITICAL in request paths even when the code "works" in development.
Audit the ! suppressions
Every nullability suppression the review flags was a place someone overruled the compiler — verify they were right.
Four language-mechanical traps, added as checklist items 13 to 16: .Result or .Wait() async-deadlock risk, undisposed IDisposable instances missing using statements, LINQ enumerated multiple times, and nullable annotations silenced with !. Code Review Prompt Generator writes these on top of the twelve generic checks; the prompt then runs in your own assistant, which surfaces candidate findings, not a guarantee it caught them all.
It reports findings only; the prompt states "Review only — report findings; do not rewrite the code." Each finding lands as one bullet with a severity tag and the exact line, function, or symbol cited, grouped CRITICAL first, ending in an APPROVED or CHANGES REQUIRED verdict. Applying the fixes and validating the merge stays with you.
Its RULES say "Flag every finding, regardless of size" and "No praise padding." That fits the REVIEW OBJECTIVE, a hotfix that has to be right the first time, where reading a NIT costs less than missing a CRITICAL. The SEVERITY RULES add that severity reflects impact, not effort to fix, so you triage from the tagged list yourself.
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.
Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.
"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.
getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.
A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.
Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.