Code Review Checklist for ColdFusion PRs: What Senior Devs Catch Before Merging

A good ColdFusion code review isn’t a style debate — it’s a systematic check for the specific bugs, security holes, and performance traps that CFML makes easy to introduce. Senior reviewers scan every pull request for a consistent set of things: is every query parameterized with (the SQL-injection check), is every variable inside a CFC method var/local-scoped (the ColdFusion threading bug that corrupts data under load), is shared-scope access (session/application/server) locked or handled safely, is user output encoded (encodeForHTML/encodeForJavaScript/encodeForURL — the XSS check), are errors handled without leaking stack traces, file paths, or datasource names, are credentials in environment variables rather than hardcoded, and will this query pattern scale (no N+1, no unbounded loops holding connections). The best teams encode as much of this as possible into automated gates — CFLint for the mechanical checks, "block the merge if a changed cfquery lacks cfqueryparam" — so human reviewers focus on logic and design. This guide is that checklist, organized by what senior ColdFusion devs actually catch before approving a PR.
Read More