oncokb-database-review

Look for loop-driven query patterns where an initial query triggers per-row follow-up queries, especially ORM lazy-loading inside loops or serializers. Fix them with batching, eager loading, join-based fetches, or precomputed maps.

Use parameterized queries or prepared statements for all user-influenced input. When dynamic SQL is unavoidable, such as dynamic ORDER BY clauses, enforce strict allowlists for identifiers and operators instead of concatenating request values.

Pagination breaks when ORDER BY lacks a unique tie-breaker, so rows with equal sort keys shift between pages. Always append a unique column like id to the ordering to guarantee deterministic results across pages.

Cover N+1 query risks, SQL injection via unparameterized input, and deterministic pagination ordering as required checks. Also verify supporting indexes, transaction scope, lock contention, soft-delete predicates, and migration safety for high-risk changes.

Manual review catches logic-level issues but cannot measure actual query counts or execution plans under load. Combine it with query logging, APM tracing, and load testing for high-traffic endpoints and concurrency-sensitive write paths.