Home › Vibe Coding Prompts › Code Review

Category · Code Review

Code Review Prompts

6 prompts to get honest, specific feedback on your code. Security, edge cases, performance, readability — like having a senior dev on call at 2 AM.

Best practice: Run these prompts before you open a PR. Catch the obvious issues yourself, then request human review for what AI can't handle (context, taste, team conventions).

Full security review

Use before merging any code that touches user input, auth, database queries, or external APIs. This is the highest-value review prompt.

Review this code for security issues: [paste the code] Context: [what this code does and who can call it] Check for: 1. Injection (SQL, command, template, header) 2. Authentication bypass or privilege escalation 3. Authorization flaws (can user A access user B's data?) 4. Secrets, tokens, or keys in logs or responses 5. Unsafe deserialization 6. Path traversal 7. SSRF (server-side request forgery) 8. Race conditions in auth/state For each finding: - The exact line - The attack vector (how it's exploited) - The severity (critical / high / medium / low) - The fix If you find nothing critical, say so explicitly. Don't invent issues.

What you should expect

A structured list of findings with severities. If AI finds 0 critical issues, verify with a second pass: "Look again specifically for auth and injection. Assume there's something."

Edge case hunt

Use when you're confident the happy path works but haven't tested everything. AI excels at systematically generating edge cases you'd never think of.

What inputs would break this function? [paste the function] The function is supposed to: [what it does] Check these categories: - Empty (empty string, empty array, empty object) - Null / undefined / NaN - Very large numbers (overflow, precision loss) - Negative numbers or backwards ranges - Unicode, emoji, RTL text - Whitespace-only strings - Special characters (quotes, backslashes, newlines) - Concurrent access (if applicable) - Malformed input matching the expected shape For each case: 1. What would happen with this input? 2. Is that the correct behavior? 3. If not, what's the fix? Then give me a list of test cases to add.

What you should expect

A list of edge cases, most of which will surprise you. The "list of test cases" at the end is the real value — copy them into your test file.

Performance review

Use when code is slow or you're scaling. AI identifies algorithmic issues, unnecessary allocations, and repeated work — fast.

Review this code for performance: [paste the function] Expected data size: [N items, requests per second, etc.] Performance requirement: [response time target] Analyze: 1. Time complexity — what's the big-O? 2. Space complexity — any unnecessary allocations? 3. Repeated work — anything computed twice? 4. Blocking operations — anything that should be async? 5. N+1 queries or loops that call I/O For each issue: - The line - The impact (with estimated cost at this scale) - The fix - The tradeoff (if any) Prioritize fixes by actual impact. If performance is already optimal, say so.

What you should expect

A complexity analysis and prioritized list. If AI suggests micro-optimizations before fixing an O(n²) issue, push back: "What's the biggest bottleneck?"

Readability & maintainability review

Use before handing code off to another developer. Will they understand it in 6 months without explanation?

Review this code for readability and maintainability: [paste the code] Imagine a new developer joined the team. They're competent but unfamiliar with this codebase. Answer: 1. What would confuse them on first read? 2. Which names don't reflect what things actually do? 3. Which comments are missing, and where? 4. Which logic deserves extraction into a named function? 5. Is there duplicated knowledge that should live in one place? 6. Are there magic numbers or strings that need constants? For each issue, propose the specific improvement. Do NOT rewrite the whole file — just list targeted changes.

What you should expect

A list of specific improvements, not a full rewrite. If AI says "the code is fine," push back: "Pick the top 3 things a new dev would trip on."

Test coverage gap analysis

Use before shipping code with tests. AI sees what's missing better than humans — it knows the common patterns for your stack.

Analyze test coverage for this function: [paste the function] Existing tests: [paste the test file] Tell me: 1. What branches are NOT covered? 2. What error paths are NOT tested? 3. What boundary conditions are missing? 4. What integration scenarios aren't tested? For each gap, write the test as a title + first line of the assertion: - "should [behavior] when [condition]" expect(() => fn()).toThrow() Prioritize by risk. Not everything needs 100% coverage — flag which gaps are critical vs nice-to-have.

What you should expect

A list of missing tests, most of which you'll agree with. Copy the test titles into your file and let AI write the bodies one by one.

API design review

Use when designing a public interface — a library, an internal API, or a service contract. AI is good at spotting awkward interfaces.

Review this API design: [paste the interface, function signatures, or endpoint spec] Intended users: [internal team, external developers, etc.] Analyze: 1. Is it easy to use correctly? 2. Is it hard to use incorrectly? 3. Are the naming choices consistent? 4. Are defaults sensible? 5. Is error handling predictable? 6. Does it force the caller to know implementation details? 7. What would the 3 most common usage patterns look like? For each issue, show the "before" and the "after" — a proposed change. Then give me the top 3 changes I should make before shipping this API.

What you should expect

A design critique with concrete before/after examples. If AI says "looks good," push back: "What would a first-time user get wrong?"

🎯 How to get better reviews from AI

State what you're worried about. "Check for security issues" gets shallow review. "I'm worried about SQL injection in the search function" gets a focused one.
Give context, not just code. Who calls this? What's the input source? What's the threat model?
Ask for a specific lens. "Review this for X" beats "review this." Do multiple focused reviews rather than one shallow one.
Don't accept "looks good." If a review finds nothing, ask: "If you had to find one issue, what would it be?"
Use AI review as a first pass. It catches obvious issues. It misses business logic and context. A human reviewer is still essential.

❓ Frequently asked questions

Can AI really review my code like a senior developer?

For specific, bounded questions (security, edge cases, performance), yes. For architectural feedback and team-context decisions, no. Use AI review as a first pass, not a replacement for human review on critical code.

What should I include in a code review prompt?

The code itself, what it's supposed to do, any constraints (performance, compatibility), and what you're most worried about. The last one shapes what AI looks for.

How do I get AI to be more critical?

Explicitly ask it to be skeptical. Try: 'Assume this code has bugs. Find them.' Or: 'If you were a security auditor, what would you flag first?' Direct prompts produce direct reviews.

Should I trust AI security reviews?

As a starting point, yes. AI catches common issues (SQL injection, XSS, missing auth checks) reliably. It misses business-logic flaws and subtle race conditions. Always pair AI review with human review for security-critical code.

What is the best AI for code review?

Claude and GPT-5 series both excel. Claude tends to be more thorough on reasoning. GPT-5 is faster. Cursor's inline review is convenient for small changes. For a full file, paste it into Claude.ai or ChatGPT with a review prompt.

🔗 Related

🐛 Debugging Prompts

When review reveals a bug.

🔧 Refactoring Prompts

Act on review feedback.

🏗️ Architecture Prompts

Reviews for larger systems.

📋 All Prompts

Back to library.

← All Prompts