What to examine.
CORRECTNESS
Does it do what it claims?
Are edge cases handled: empty, missing, very large, concurrent?
What happens when a dependency fails?
SECURITY
Is every input validated on the server? Are queries parameterised? Is authorisation checked on the record? Are secrets absent? Is anything sensitive logged?
DATA
Are migrations reversible? Will this lock a large table? Are the right indexes present? Are queries issued in loops?
OPERATIONS
Are errors handled and logged usefully? Are timeouts set on external calls? Is this safe to run twice? Can this be reverted?
MAINTAINABILITY
Clear names? Reasonable size? Business logic in the right layer? Anything duplicated?
WHAT TO AUTOMATE BEFORE REVIEW
Formatting, linting, type checking, tests.
WHY
So review addresses what only a person can judge.
WHAT TO RAISE FIRST
Security and data issues, which are the expensive ones.
