DEV Community

Suifeng023
Suifeng023

Posted on

I Replaced My Code Reviewer with AI — Here's the Exact Prompt Workflow That Catches 90% of Bugs

#ai #codereview #programming #productivity

I Replaced My Code Reviewer with AI — Here's the Exact Prompt Workflow That Catches 90% of Bugs

My senior colleague used to spend 4 hours a day reviewing pull requests. When he left the company, our bug rate doubled.

Then I built an AI-powered code review pipeline using Claude that catches bugs, security issues, and performance problems in under 5 minutes per PR.

After 6 months and 400+ PRs reviewed, here's the complete system that actually works.

Why Most AI Code Reviews Suck

I've seen teams try "AI code review" and give up within a week. Here's what goes wrong:

  • ❌ Too vague: "Review this code" → gets generic "looks good" responses
  • ❌ No context: AI doesn't know your coding standards, architecture, or business logic
  • ❌ Reviewing everything: AI flags style issues and misses actual bugs
  • ❌ No triage: Everything looks equally important

The fix? Give AI a specific role, context, and review checklist.

My 5-Step AI Code Review System

Step 1: The PR Summary Prompt

Before reviewing code, have AI summarize what changed:

You are a senior software engineer reviewing a pull request.

## PR Information
- Title: {pr_title}
- Description: {pr_description}
- Files changed: {list_of_files}
- Lines added: {lines_added}
- Lines removed: {lines_removed}

## Diff
{git_diff}

Analyze this PR and provide:
1. ONE SENTENCE summary of what this PR does
2. List of files changed and WHY each was modified
3. Any files that were modified but seem unrelated to the PR purpose
4. A risk assessment (Low/Medium/High) with reasoning
Enter fullscreen mode Exit fullscreen mode

This alone catches 20% of problems — unrelated changes, scope creep, and PRs that do more than they claim.

Step 2: The Bug Hunt 

Continuing with the same PR, now perform a thorough bug analysis.

Check for:
1. **Logic errors** — off-by-one, wrong conditions, missing edge cases
2. **Null/undefined handling** — any place where a value could be null/undefined
3. **Race conditions** — concurrent access, async timing issues
4. **Resource leaks** — unclosed connections, missing cleanup, memory leaks
5. **Error handling** — unhandled promise rejections, swallowed errors
6. **Data integrity** — partial updates, inconsistent state, missing transactions

For each issue found:
- File and line number
- Severity: 🔴 Critical / 🟡 Warning / 🔵 Suggestion
- What the bug is
- Why it's a problem (real scenario)
- Suggested fix (code snippet)
Enter fullscreen mode Exit fullscreen mode

Step 3: Security Review 

Now perform a security-focused review of this PR.

Check for:
1. **Injection attacks** — SQL injection, XSS, command injection
2. **Authentication/Authorization** — missing auth checks, privilege escalation
3. **Data exposure** — sensitive data in logs, responses, or error messages
4. **Input validation** — missing validation, type coercion issues
5. **Dependency risks** — new packages added, known vulnerabilities
6. **Secrets** — hardcoded credentials, API keys, tokens
7. **CORS/misconfiguration** — overly permissive headers, settings

Rate each finding: 🔴 Critical / 🟡 Warning / 🔵 Info
Provide specific remediation for each.
Enter fullscreen mode Exit fullscreen mode

Step 4: Performance Analysis 

Now review this PR for performance issues.

Check for:
1. **N+1 queries** — database calls inside loops
2. **Missing indexes** — queries that would benefit from indexes
3. **Unnecessary re-renders** — React component optimization issues
4. **Memory inefficiency** — large arrays, unnecessary cloning, closure leaks
5. **Blocking operations** — synchronous I/O, heavy computations on main thread
6. **Pagination** — endpoints that load all records instead of paginating
7. **Caching opportunities** — repeated identical computations or queries

For each issue:
- Where it is (file:line)
- Impact: 🟡 Moderate / 🔴 High
- How to fix it (code example)
- Estimated performance improvement
Enter fullscreen mode Exit fullscreen mode

Step 5: The Final Scorecard 

Based on all reviews above, generate a final scorecard:

## PR Scorecard

**Overall Assessment:** [Approve / Request Changes / Comment]

**Issues Summary:**
- 🔴 Critical: {count}
- 🟡 Warnings: {count}
- 🔵 Suggestions: {count}

**Strengths:**
- [What the PR does well]

**Must Fix Before Merge:**
- [Only critical/warning items]

**Nice to Have:**
- [Suggestions for future improvement]

**One-line review comment for the author:**
[Constructive, specific feedback]
Enter fullscreen mode Exit fullscreen mode

Real Examples: Bugs AI Caught That Humans Missed

Example 1: The Silent Data Loss

A developer submitted a PR to add bulk user deletion:

// BEFORE AI review - looks fine at first glance
async function deleteUsers(userIds) {
  for (const id of userIds) {
    await db.query('DELETE FROM users WHERE id = $1', [id]);
  }
  return { success: true };
}
Enter fullscreen mode Exit fullscreen mode

AI caught:

🔴 Critical — Missing cascade delete. Users have related records in orders, sessions, and audit_logs tables. This will either fail with foreign key violations or leave orphaned records depending on your DB constraints.

Fixed version AI suggested:

async function deleteUsers(userIds) {
  const result = await db.transaction(async (tx) => {
    await tx.query('DELETE FROM audit_logs WHERE user_id = ANY($1)', [userIds]);
    await tx.query('DELETE FROM sessions WHERE user_id = ANY($1)', [userIds]);
    await tx.query('DELETE FROM orders WHERE user_id = ANY($1)', [userIds]);
    const { rowCount } = await tx.query('DELETE FROM users WHERE id = ANY($1)', [userIds]);
    return rowCount;
  });
  return { success: true, deleted: result };
}
Enter fullscreen mode Exit fullscreen mode

Example 2: The Auth Bypass 

// Middleware that "validates" admin access
function requireAdmin(req, res, next) {
  if (req.user.role === 'admin') {
    next();
  }
}
Enter fullscreen mode Exit fullscreen mode

AI caught:

🔴 Critical — Missing else clause. If user is not admin, the request hangs and eventually times out instead of returning 403. Also, no check for req.user being undefined (unauthenticated requests pass through).

Example 3: The $5,000/Month Query 

// Dashboard endpoint that loads user analytics
app.get('/api/dashboard', async (req, res) => {
  const users = await db.query('SELECT * FROM users');
  const dashboardData = await Promise.all(
    users.rows.map(user => 
      db.query('SELECT * FROM analytics WHERE user_id = $1', [user.id])
    )
  );
  res.json(dashboardData);
});
Enter fullscreen mode Exit fullscreen mode

AI caught:

🔴 High — Classic N+1 query. Loading ALL users then querying analytics for each one individually. With 10,000 users, this makes 10,001 database queries per dashboard load.

Fixed version:

app.get('/api/dashboard', async (req, res) => {
  const dashboardData = await db.query(`
    SELECT u.id, u.name, a.* 
    FROM users u
    JOIN analytics a ON a.user_id = u.id
    WHERE u.created_at > NOW() - INTERVAL '30 days'
  `);
  res.json(dashboardData.rows);
});
Enter fullscreen mode Exit fullscreen mode

How to Integrate This Into Your Workflow

Option 1: Claude Desktop (No Setup)

Copy-paste each step prompt into Claude with your git diff. Takes 5 minutes per PR.

Option 2: GitHub Actions (Automated)

Create a .github/workflows/ai-review.yml that triggers on PRs and posts review comments automatically.

Option 3: Git Hook (Local)

Add a pre-push hook that runs AI review before allowing pushes.

The Results After 6 Months

Metric Before AI Review After AI Review
Bugs reaching production 12-15/month 2-3/month
Average review time 4 hours 8 minutes
Security vulnerabilities 8 caught/quarter 23 caught/quarter
Code review coverage 60% of PRs 100% of PRs

The biggest win wasn't catching bugs — it was consistency. Every PR gets the same thorough review, regardless of who submits it or how busy the team is.

Tips for Getting the Best Results

  1. Include context — The more AI knows about your project, the better it reviews
  2. Start with Steps 1-2 — Add security and performance reviews once you trust the basics
  3. Customize checklists — Add items specific to your stack (e.g., React hooks rules, Python type hints)
  4. Use AI as a first pass — Still have humans review complex architectural changes
  5. Feed it your style guide — Include your coding standards in the system prompt

Final Thoughts

AI code review isn't about replacing developers — it's about giving every PR the attention of a senior engineer who has infinite time and never gets tired.

The 5-step system above is the result of hundreds of iterations. Start with it, customize it for your team, and watch your bug rate plummet.

Found this useful? Check out my AI Prompt Packs:

Top comments (0)