What to look for.
CORRECTNESS
Does it do what it claims?
Are edge cases handled: empty, missing, boundary, duplicate?
What happens on failure?
SECURITY
Is every input validated? Are queries parameterised? Is output escaped? Are credentials outside the code? Is anything logged that should not be?
STRUCTURE
Does each function do one thing? Is anything repeated that should be shared? Is logic separated from external access?
READABILITY
Do the names say what things are? Could someone unfamiliar follow it? Are comments explaining why rather than what?
ERRORS
Are specific exceptions caught, rather than everything? Is anything silenced? Are resources cleaned up?
PERFORMANCE
Is work repeated inside a loop? Are queries issued per item? Is everything loaded into memory?
DEPENDENCIES
Is anything new genuinely needed?
TESTS
Do they exist for what matters, and do they pass?
