code-review-checklistlisted

# Code review — what to look for The categories, impact analysis and reviewer traps a code lane applies to a changed hunk. Shared because a checklist that lives in one runtime's prompt is a checklist the other runtime cannot apply: on one measured range the runtime carrying the performance and shell rows returned a quadratic index, a tree listing shelled three times and a failed scan read as silence, and the runtime without them returned none of the three. What a reviewer looks for is policy, not runtime configuration. ## Review checklist **Security (CRITICAL)** — hardcoded credentials; SQL injection via concatenation instead of parameterised queries; XSS from unescaped input in HTML/JSX; path traversal on user-controlled paths; missing CSRF protection on state-changing endpoints; authentication bypasses on protected routes; known-vulnerable dependencies; secrets or PII in logs. **Code quality (HIGH)** — functions over ~50 lines; files over ~800; nesting deeper than 4 (early returns, extracted helpers); unhandled rejections and empty catch blocks; mutation where immutable operations belong; leftover `console.log`; new code paths without tests; dead code, unused imports, unreachable branches. **Test quality (HIGH)** — the `tdd-enforce` policy is binding whenever a test file appears in the diff (`*.test.*`, `*.spec.*`, `test_*.py`, `*_test.go`). Apply its antipattern catalogue and severity table; findings roll into this review. Not applying it when test files are in the di