Code Review Prompt Guide

Perform a security-focused code review on this [LANGUAGE] code.

CONTEXT:
- Application type: [web app, API, CLI tool, etc.]
- Handles sensitive data: [yes/no, what kind]
- Authentication method: [JWT, session, API key, etc.]
- Database: [PostgreSQL, MongoDB, etc.]

CODE TO REVIEW:
[paste code]

CHECK FOR THESE VULNERABILITIES:
1. Injection attacks (SQL, NoSQL, command, LDAP)
2. Authentication/authorization bypasses
3. Sensitive data exposure (logs, errors, responses)
4. Insecure cryptographic practices
5. Race conditions and TOCTOU bugs
6. Input validation gaps
7. Hardcoded secrets or credentials

OUTPUT FORMAT:
For each finding:
- SEVERITY: [Critical/High/Medium/Low]
- LOCATION: [file:line or function name]
- ISSUE: [clear description]
- EXPLOIT SCENARIO: [how an attacker could use this]
- FIX: [code example of the fix]

Analyze this [LANGUAGE] code for performance issues.

CONTEXT:
- Expected load: [requests/sec, data volume, concurrent users]
- Current performance: [if known, e.g., "p99 latency is 2s, should be 200ms"]
- Runtime environment: [Node.js, Python, Go, browser, etc.]
- Database: [if applicable]

CODE TO REVIEW:
[paste code]

ANALYZE FOR:
1. Algorithm complexity (O(n) improvements)
2. Unnecessary loops or repeated operations
3. N+1 query patterns
4. Memory allocation inefficiencies
5. Blocking operations in async contexts
6. Missing caching opportunities
7. Inefficient data structures

FOR EACH ISSUE:
- IMPACT: [High/Medium/Low impact on performance]
- LOCATION: [where in the code]
- CURRENT COMPLEXITY: [O(n^2), etc.]
- PROBLEM: [why this hurts performance]
- OPTIMIZED VERSION: [show the faster code]
- EXPECTED IMPROVEMENT: [rough estimate]

Review this code for architectural and design issues.

CONTEXT:
- Project type: [monolith, microservice, library, etc.]
- Team size: [solo, small team, large org]
- Expected lifetime: [prototype, long-term product]
- Architecture pattern: [MVC, Clean Architecture, etc.]

CODE TO REVIEW:
[paste code]

EVALUATE AGAINST:
1. Single Responsibility Principle violations
2. Tight coupling between components
3. Missing abstractions or over-abstraction
4. Inconsistent patterns across codebase
5. Hard-to-test code (dependencies, side effects)
6. Missing error boundaries
7. Scalability concerns

FOR EACH FINDING:
- PRINCIPLE VIOLATED: [which design principle]
- LOCATION: [where in the code]
- CURRENT STATE: [what the code does now]
- PROBLEM: [why this will cause pain]
- REFACTORED VERSION: [show better structure]
- TRADEOFFS: [when NOT to make this change]

Review this code for logic errors and edge cases.

CONTEXT:
- Business domain: [e-commerce, finance, healthcare, etc.]
- Critical requirement: [what MUST work correctly]
- Known constraints: [max values, valid ranges, etc.]

CODE TO REVIEW:
[paste code]

LOOK FOR:
1. Off-by-one errors in loops/ranges
2. Null/undefined handling gaps
3. Integer overflow possibilities
4. Floating point precision issues
5. Time zone / date handling bugs
6. Race conditions in async code
7. Boundary conditions (empty, max, negative)
8. Business logic inconsistencies

FOR EACH FINDING:
- EDGE CASE: [describe the scenario]
- INPUT THAT BREAKS IT: [concrete example]
- EXPECTED BEHAVIOR: [what should happen]
- ACTUAL BEHAVIOR: [what currently happens]
- FIX: [code that handles the edge case]