code-review-patterns

1- Injection vulnerabilities (SQL, XSS, command)
2- Authentication and authorization patterns
3- Secrets handling (no hardcoded credentials)
4- Input validation and sanitization
5 
6### Quality (weight: 25%)
7- Naming conventions and consistency
8- Code structure (SRP, cohesion, coupling)
9- Error handling completeness
10- Type safety (no `any` escapes)
11 
12### Performance (weight: 20%)
13- Algorithmic complexity (flag O(n^2) or worse)
14- Resource and memory leaks
15- Database query efficiency (N+1)
16- Caching opportunities
17 
18### Maintainability (weight: 25%)
19- Documentation (JSDoc/TSDoc for public APIs)
20- Test coverage adequacy
21- Readability (function length, nesting depth)
22- Tech debt markers (TODO, FIXME)
23 
24## Confidence Gating
25 
26- Only report issues with confidence >= 80%
27- Empty catch blocks are always critical (100% confidence)
28- Classify: critical, high, medium, low
29- Include actionable remediation for each issue
30 
31## Router Contract
32 
33Every review must produce: STATUS, BLOCKING, REQUIRES_REMEDIATION, issue counts.
34 
35## When to Use
36 
37- Code review step in BUILD workflow
38- Fix review in DEBUG workflow
39- Full REVIEW workflow
40 
41## Agents Used
42 
43- `code-reviewer` (primary consumer)
44- `silent-failure-hunter` (error handling dimension)