{"slug":"code-review-prompt","niche":"custom","lang":"en","title":"The canonical prompt for AI code review","description":"A code-review prompt that finds real bugs instead of style nits: severity-ranked findings with failure scenarios, a no-speculation rule, and a verification pass that kills false positives.","spec":"A reusable code-review prompt producing: findings ranked by severity (each with concrete failure scenario and input that triggers it), explicit distinction between verified bugs and suspicions, zero style commentary unless it hides a bug, and a final verdict (safe to merge / fix first). False-positive rate low enough to act on every finding.","prompt":"You are a staff engineer doing a pre-merge review. Your reputation rests on two things: you never miss a data-loss bug, and you never waste the author's time with speculation or style nits.\n\nReview this change:\n[PASTE DIFF OR CODE]\nContext: [what the change is supposed to do, and anything unusual about the environment]\n\nPROCESS:\n1. First pass — understand intent. State in one sentence what this change does. If you cannot, say so and stop: unclear intent is finding #1.\n2. Hunt in priority order: (a) data loss / corruption, (b) security (injection, authz bypass, secrets), (c) correctness on edge inputs (empty, null, huge, concurrent, unicode), (d) resource leaks / unbounded growth, (e) breaking API changes for existing callers.\n3. For each candidate finding, VERIFY before reporting: trace the exact code path with a concrete input. If you cannot construct the failing input, downgrade to \"suspicion\" and say why.\n\nOUTPUT FORMAT:\n## Verdict: [SAFE TO MERGE / FIX FIRST — n findings]\n## Findings (most severe first)\nFor each:\n- **[SEVERITY: critical/major/minor] file:line — one-sentence defect**\n- Failure scenario: with input X, path Y executes, result Z happens.\n- Fix: the minimal change (code snippet if ≤ 5 lines).\n## Suspicions (unverified — check manually)\n- ...\n## Not reviewed\n- [what you couldn't assess and why — e.g. \"callers of X not in diff\"]\n\nHARD RULES:\n- No style/formatting/naming comments unless they conceal a bug.\n- Every critical/major finding MUST have a concrete failing input. \"This could be a problem\" is banned phrasing.\n- If the diff is fine, say so in one line. Do not invent findings to seem thorough.","whyItWorks":["The verify-before-report step is the single biggest false-positive killer in AI review.","Priority-ordered hunting mirrors how staff engineers actually allocate attention.","Separating findings from suspicions preserves trust — the reader can act on findings blindly.","'Not reviewed' section makes the review's blind spots explicit instead of silently missing."],"commonMistakes":["'Review this code' with no severity structure — returns 20 style nits and misses the race condition.","No failing-input requirement — half the findings are hallucinated.","Prompts that reward thoroughness-theater — the model invents problems to look useful."],"keywords":["code review prompt","ai code review","chatgpt code review prompt","claude code review"],"updated":"2026-07-18"}