code-reviewlisted

# Code Review ## Overview Code review is not proofreading — it's a systematic evaluation of whether a change is correct, safe, maintainable, and appropriately scoped. An agent reviewing code must follow a consistent priority order, not scan for whatever catches its eye first. ## The iron law ``` REVIEW IN PRIORITY ORDER: SECURITY → CORRECTNESS → PERFORMANCE → STYLE ``` Security bugs that slip through review cause incidents. Correctness bugs cause regressions. Performance issues cause gradual degradation. Style issues cause friction. Review in order of impact. ## The review process ### 1. Understand the intent first Before reading a single line of code: - Read the PR description, linked issue, or design doc. - Understand what the change is *supposed* to do. - If the intent is unclear, ask before reviewing the implementation. ### 2. Review in priority order **Security (blocking):** - Does user input flow into queries, commands, or markup unsanitized? - Are secrets hardcoded or logged? - Are authorization checks present at the data layer, not just the route? - Does the change introduce new attack surface (new endpoints, new file uploads, new auth flows)? **Correctness (blocking):** - Does the code actually implement the stated intent? - Are edge cases handled (empty input, null, boundary values, concurrency)? - Are error paths handled (what happens when the network call fails, the file doesn't exist, the database is down)? - Does it have tests? Do the tests cover