ColdFusion Code Review Checklist: What Senior Devs Check Before Merging CFML

A senior ColdFusion reviewer isn’t reading for style — they’re scanning for the specific CFML mistakes that cause security holes, production outages, and hard-to-debug behavior. The non-negotiables: every database query uses (or parameterized queryExecute()) — string-concatenated SQL is an automatic block, because SQL injection is the top ColdFusion threat; all user-controlled output is encoded with the context-appropriate encodeForHTML() / encodeForJavaScript() / encodeForURL() to stop XSS; every function-local variable is var/local-scoped and every variable reference is explicitly scoped, because unscoped variables cause race conditions and collisions; errors are handled with try/catch and logging, not swallowed or dumped to the user; debugging output is off and no sensitive data (keys, connection strings, stack traces) leaks; and the change is tested, readable, and doesn't introduce N+1 queries or session-scope bloat. The best teams automate the mechanical half of this with CFLint so humans focus on logic and security. This guide is the field-tested checklist, grouped the way an experienced reviewer actually works through a CFML pull request.
Read More