code review
**Code Review Best Practices** are the **established guidelines for systematically examining source code changes to identify bugs, improve quality, share knowledge, and maintain codebase consistency** — encompassing what to look for (correctness, performance, security, readability), how to give feedback (constructive, specific, actionable), and how to structure the review process (small PRs, timely reviews, clear approval criteria) to maximize the value of code review as both a quality gate and a team learning mechanism.
**What Is Code Review?**
- **Definition**: The systematic examination of source code changes by one or more developers other than the author — reviewing proposed changes (pull requests, merge requests) for correctness, adherence to coding standards, performance implications, security vulnerabilities, and maintainability before merging into the main codebase.
- **Quality Gate**: Code review catches bugs that automated testing misses — logic errors, race conditions, edge cases, and architectural issues that require human judgment to identify.
- **Knowledge Sharing**: Reviews spread codebase knowledge across the team — reviewers learn about parts of the system they don't normally work on, and authors learn better patterns from reviewer feedback.
- **Standards Enforcement**: Reviews ensure consistent coding style, naming conventions, error handling patterns, and architectural decisions — maintaining codebase coherence as the team grows.
**What to Review**
| Category | What to Check | Common Issues |
|----------|-------------|--------------|
| Correctness | Logic, edge cases, error handling | Off-by-one, null handling, race conditions |
| Performance | Algorithm complexity, memory usage | O(n²) loops, unnecessary allocations, N+1 queries |
| Security | Input validation, auth, secrets | SQL injection, XSS, hardcoded credentials |
| Readability | Naming, comments, structure | Unclear names, missing context, deep nesting |
| Testing | Coverage, edge cases, assertions | Missing tests, weak assertions, flaky tests |
| Architecture | Separation of concerns, coupling | God classes, circular dependencies |
**Clean Code Principles**
- **Single Responsibility**: Each function/class does one thing well — if you need "and" to describe what it does, it should be split.
- **DRY (Don't Repeat Yourself)**: Extract shared logic into reusable functions — duplicated code means duplicated bugs and maintenance burden.
- **KISS (Keep It Simple)**: Prefer straightforward solutions over clever ones — code is read 10× more than it's written.
- **Meaningful Names**: Variables and functions should reveal intent — `user_count` not `n`, `is_valid_email()` not `check()`.
- **Small Functions**: Functions under 20 lines are easier to understand, test, and reuse — extract complex logic into well-named helper functions.
**Review Etiquette**
- **Be Constructive**: Frame feedback as suggestions, not demands — "Consider using a map here for O(1) lookup" rather than "This is wrong."
- **Explain the Why**: Don't just say what to change, explain why — helping the author learn and make better decisions independently.
- **Distinguish Severity**: Separate blocking issues (bugs, security) from suggestions (style, optimization) — don't block merges over nitpicks.
- **Be Timely**: Review within 24 hours — stale PRs create merge conflicts and block the author's progress.
- **Acknowledge Good Work**: Call out clever solutions and clean code — positive feedback reinforces good practices.
**Code review is the team practice that catches bugs, shares knowledge, and maintains code quality** — combining systematic examination of changes with constructive feedback to create a continuous improvement cycle that makes the codebase more reliable, readable, and maintainable over time.