code-review

Check all user input paths for validation, verify queries use parameterized statements instead of string concatenation, confirm secrets come from environment variables, and ensure authentication and authorization checks protect every resource. The review covers SQL injection, XSS, CSRF, IDOR, and path traversal.

A thorough checklist covers readability, naming conventions, function size, error handling, security checks, and performance patterns. Prioritize correctness first, then security, readability, and performance in that order.

Look for O(n) array lookups that could use Maps, sequential awaits that should use Promise.all, N+1 database queries, unbounded queries without pagination, and synchronous file operations blocking the event loop.

Refactor when functions exceed 30 lines, files exceed 300 lines, logic is duplicated, or nesting goes beyond 3 levels. Cover existing behavior with tests first, make one small change at a time, and run tests after each change.

Instant red flags include empty catch blocks that swallow errors, console.log left in production code, hardcoded credentials or localhost URLs, SELECT * queries, eval() with user data, and Math.random() used for security tokens.