Code Review with Claude Code
Get thorough, actionable code reviews from Claude Code for any codebase.
Quick Reference
| Review Type | When to Use | Prompt Pattern | |-------------|-------------|----------------| | General | New features, refactors | "Review @file for issues" | | Security | Auth, data handling | "Security review @file" | | Performance | Hot paths, loops | "Performance review @file" | | Style | Consistency, standards | "Style review against @.eslintrc" | | Architecture | Design decisions | "ultrathink about @src/module/" |
Review Request Patterns
Basic Review
Review @src/api/users.ts for issues.
Focus on:
- Logic errors
- Edge cases
- Error handling
- Code clarity
Targeted Review
Review @src/auth/login.ts specifically for:
- SQL injection vulnerabilities
- Password handling
- Session management
Ignore styling issues.
Comparative Review
Review this change:
@git:diff src/api/
Compare against:
- Our patterns in @src/api/orders.ts
- Best practices for REST APIs
Review Types
Security Review
Security review @src/auth/ @src/api/
Check for:
- Input validation
- SQL injection
- XSS vulnerabilities
- Auth/authz issues
- Secrets exposure
- CSRF protection
Rate each finding: critical/high/medium/low
Performance Review
Performance review @src/services/search.ts
Analyze:
- Time complexity
- Memory usage
- Database queries (N+1?)
- Caching opportunities
- Async patterns
Style Review
Style review @src/components/ against:
@.eslintrc.js
@.prettierrc
Report:
- Naming conventions
- File organization
- Import ordering
- Component patterns
Architecture Review
ultrathink about the architecture of @src/orders/
Evaluate:
- Separation of concerns
- Dependency direction
- Coupling/cohesion
- Testability
- Extensibility
Getting Better Reviews
Provide Context
Include related files and history:
Review @src/api/payments.ts
Context:
- @src/types/payment.ts (types)
- @src/services/stripe.ts (integration)
- This replaces the old PayPal flow
- Must handle refunds within 30 days
Specify Your Concerns
Review @src/auth/session.ts
I'm specifically worried about:
1. Race conditions in token refresh
2. Session fixation attacks
3. Memory leaks from unclosed sessions
Less concerned about:
- Code style (will run linter)
- Test coverage (separate pass)
Request Actionable Feedback
Review @src/utils/parser.ts
For each issue found:
1. Explain the problem
2. Show the problematic code
3. Provide a fix
4. Rate severity
Review Output Format
Request structured output for complex reviews:
Review @src/api/ and format findings as:
## Critical
- [Issue]: [Location]: [Description]
## Improvements
- [Suggestion]: [Location]: [Benefit]
## Questions
- [Question]: [Context]
## Positive
- What's done well
Iterative Reviews
Multi-Pass Approach
# Pass 1: High-level
Review @src/orders/ for architectural issues.
Don't look at implementation details yet.
# Pass 2: After addressing Pass 1
Now review the implementation in @src/orders/service.ts
Focus on business logic correctness.
# Pass 3: Final
Security and performance review of @src/orders/
Review and Fix
Review @src/api/upload.ts for security issues.
For each critical issue:
1. Explain it
2. Fix it immediately
3. Add a test case
Thinking Keywords for Reviews
| Keyword | Review Type | Example |
|---------|-------------|---------|
| think | General review | "think about issues in @file" |
| think harder | Edge cases | "think harder about edge cases" |
| ultrathink | Security/arch | "ultrathink about security of @auth/" |
| megathink | Critical systems | "megathink about @payment/ risks" |
Review Checklists
Quick prompts for standard checks:
Run through @CHECKLIST.md for @src/api/users.ts
See CHECKLIST.md for complete checklists.
PR-Specific Reviews
Review PR #123
gh pr diff 123
Focus on:
- Does it match the PR description?
- Are tests adequate?
- Any breaking changes?
- Documentation updated?
See PR-WORKFLOWS.md for complete PR review workflows.
Review Comment Templates
Issue Found
Issue: [Brief description]
Location: [file:line]
Severity: [critical|high|medium|low]
Problem:
[Explanation of what's wrong]
Current:
[code snippet]
Suggested:
[fixed code snippet]
Why: [Reason this matters]
Suggestion
Suggestion: [Brief description]
Location: [file:line]
Impact: [performance|readability|maintainability]
Current approach:
[what code does now]
Alternative:
[better approach]
Benefit: [Why this is better]
Common Review Prompts
API Endpoint
Review @src/api/users.ts for:
- Input validation completeness
- Error response consistency
- Auth/authz checks
- Rate limiting consideration
- Logging adequacy
React Component
Review @src/components/UserCard.tsx for:
- Props validation
- Render optimization
- Hook usage
- Accessibility
- Error boundaries
Database Code
Review @src/repositories/user.ts for:
- SQL injection (even with ORM)
- N+1 query patterns
- Transaction handling
- Index usage
- Connection management
Utility Functions
Review @src/utils/validation.ts for:
- Edge case handling
- Type safety
- Error messages clarity
- Reusability
- Test coverage gaps
Reference Files
| File | Contents | |------|----------| | REVIEW-PROMPTS.md | Detailed prompts by review type | | PR-WORKFLOWS.md | Pull request review workflows | | CHECKLIST.md | Code review checklists |
Validation
After a review, verify quality:
- [ ] All critical issues addressed
- [ ] Fixes don't introduce new issues
- [ ] Tests added for bugs found
- [ ] Review comments resolved
- [ ] Code compiles and tests pass