Code review with AI
AI review makes the mechanical pass nearly free. That shifts what human review is for: architecture fit, product intent, and accepting risk. Those can't be delegated, and they're where review time should go.
Self-review before PR
Review your own AI-generated code before anyone else sees it:
"Review changes for: logic errors, OWASP top 10, performance, test gaps"Using a second agent for review
A fresh session has none of the first session's assumptions:
"Review the diff on this branch against main. Only blocking problems: file, line,
why it's wrong, how to show it fails"Automated PR reviews
Install the Claude GitHub app for review comments on every PR:
/install-github-appTune it until most of its comments are worth reading. Noisy AI review teaches people to ignore review comments, including the human ones.
Review checklist
| Category | What to check | Who owns it |
|---|---|---|
| Correctness | Does it do what it claims? Edge cases? | AI first pass, author |
| Security | Injection, auth bypass, data exposure, secrets | AI plus tools, domain owner for sensitive areas |
| Performance | N+1 queries, unnecessary loops, leaks | AI first pass |
| Maintainability | Naming, complexity, fits existing patterns | Human reviewer |
| Testing | Meaningful assertions, not just coverage | Human reviewer |
| Dependencies | New deps justified? License compatible? | Human reviewer |
| Intent | Is this the right change at all? | Human reviewer, always |
Example review prompts (short)
Security: "Review auth code for: password handling, sessions, CSRF, rate limiting"
Architecture: "Check UserService follows src/services/ patterns. Testable?"
Performance: "Check queries for: indexes, N+1, caching opportunities"
Blocking: "Review diff vs main. Only blocking problems: file, line, why wrong, how to show it fails"Running review at team scale:
- Route by ownership. CODEOWNERS sends changes to the people who own the domain. AI review doesn't replace that
- Measure it. Watch review turnaround and defects found after merge. If AI review speeds up merges but more defects reach production, tighten it
- Teach through review. Explain why, not just what. When agents write most of the code, review comments are how juniors learn judgment