code-review

Check for hardcoded secrets, missing input validation, SQL queries built with string concatenation, unvalidated file paths, and absent authentication checks. Use parameterized queries and safe DOM APIs like textContent instead of innerHTML.

A thorough checklist covers security (secrets, injection, authorization), error handling (try/catch on external calls, safe logging), code quality (function size, naming, DRY), and testing (edge cases, error paths, test coverage for new code).

Structure feedback into a summary, critical issues that must be fixed, optional suggestions, and clarifying questions. Explain why each issue matters, offer concrete fixes, and acknowledge good patterns rather than only listing problems.

Use parameterized queries instead of f-string interpolation, for example cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,)). Never concatenate user input directly into SQL statements.

Checklists catch common patterns like injection and missing error handling but cannot verify business logic correctness or architectural fit. Combine checklist reviews with testing and domain-expert review for critical systems.