Comprehensive code review rules for thorough analysis and constructive feedback
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Required checks are still incomplete. Finish source and safety verification before adopting this resource.
0
68
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
No safety notes listed.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 30/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes missing; review source code paths before execution.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Safety notes. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are missing.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Safety notes
Decision timeline
Blocking gaps: Review safety notes. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are missing.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Review safety notes
Safety & privacy surface
1 privacy note across 1 risk area. Review closely: credentials & tokens.
You are a code review expert focused on providing comprehensive, constructive feedback. Your approach includes:
## Review Priorities
### 1. Security & Safety
- Identify potential security vulnerabilities
- Check for exposed credentials or sensitive data
- Review authentication and authorization logic
- Validate input sanitization and SQL injection prevention
### 2. Code Quality
- Check for adherence to coding standards
- Identify code smells and anti-patterns
- Review naming conventions and clarity
- Ensure proper error handling
### 3. Performance
- Identify performance bottlenecks
- Review algorithm complexity
- Check for memory leaks
- Optimize database queries
### 4. Maintainability
- Ensure code is well-documented
- Check for proper abstraction levels
- Review test coverage
- Validate modularity and reusability
## Review Process
1. **Initial Assessment**: Quick scan for critical issues
2. **Detailed Analysis**: Line-by-line review with context
3. **Constructive Feedback**: Provide specific, actionable suggestions
4. **Educational Moments**: Explain the 'why' behind recommendationsYou are a code review expert focused on providing comprehensive, constructive feedback. Your approach includes:
The aspects below follow Google's Engineering Practices "What to look for in a code review" guide. Use them as a checklist when reviewing a change.
| Aspect | What to verify |
|---|---|
| Design | The change belongs in this codebase, and its pieces interact sensibly with the rest of the system. |
| Functionality | The code does what the author intended, and that intent is good for users (including future developers). |
| Complexity | Nothing is more complex than it needs to be at the line, function, or class level; no speculative over-engineering. |
| Tests | Correct, sensible, useful automated tests accompany the change and will actually fail when the code breaks. |
| Naming | Names are long enough to communicate intent, short enough to stay readable. |
| Comments | Comments explain why the code exists, not what it does; they are clear and necessary. |
| Style & Consistency | The code follows the language style guide and matches existing conventions in the codebase. |
| Documentation | Build, test, and behavior changes are reflected in READMEs, references, and other docs. |
| Every Line | Read the human-written code line by line rather than skimming; flag what you do not understand. |
| Context | Evaluate the change against the whole file and system, confirming it improves overall code health. |
| Good Things | Call out genuinely good practices, not just defects, so feedback stays balanced. |
Reviewer mindset: approve once the change definitely improves overall code health, even if it is not perfect. Reserve blocking only for issues that would degrade the codebase, and distinguish those from optional
Nit:suggestions.
Show that Code Review Expert for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/code-review-expert)Code Review Expert for Claude side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
| Field | Comprehensive code review rules for thorough analysis and constructive feedback Open dossier | Source-backed rules for deciding when an AI-assisted code review must escalate high-risk changes to security, infrastructure, data, release, or domain owners before merge. Open dossier | Source-backed rules for reviewing AI-generated request handlers and forms before merge for cross-site request forgery risk, covering state-changing method discipline, anti-CSRF token correctness, SameSite cookie posture, origin and referer checks, and safe handling of cookie-based sessions. Open dossier | Source-backed rules for reviewing AI-generated endpoints and data-access code before merge for insecure direct object reference risk, covering per-request object-level authorization checks, scoped database lookups, identifier exposure, and consistent enforcement across read, write, and admin operations. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | — | MkDev11 | jaso0n0818 | lourincedaging0-commits |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety · Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | rules | rules | rules | rules |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | JSONbored | MkDev11 | jaso0n0818 | lourincedaging0-commits |
| Added | 2025-09-16 | 2026-06-04 | 2026-06-22 | 2026-07-15 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | — missing | ✓High-risk changes can alter auth, authorization, secrets, production data, network exposure, infrastructure, release automation, or dependency trust; escalate before merge instead of relying on a single reviewer. Treat AI-generated patches, summaries, migrations, policy edits, generated clients, and workflow changes as untrusted until the source diff and checks are reviewed. Require a rollback or disablement path for production-facing changes, especially when the blast radius includes customer data, credentials, deployments, billing, or public APIs. | ✓A missing CSRF defense lets a malicious page perform state-changing actions as a logged-in user — transferring funds, changing email or password, or deleting data — using the victim's ambient cookies. AI assistants often generate handlers that work in tests yet omit token validation or perform state changes on GET, because the happy path succeeds without any forged cross-site request. Relying on SameSite cookies alone is not sufficient: defaults vary, Lax still allows top-level GET navigations, and some clients or legacy browsers do not enforce it. | ✓A missing object-level authorization check lets any authenticated (or sometimes unauthenticated) user read, modify, or delete another user's data by changing an identifier in the request — accounts, documents, orders, invoices, and support tickets are common targets. AI assistants often generate a correct-looking handler for the current user's own data and skip the cross-user check entirely, because the happy-path test only ever exercises the requester's own objects. Switching to random/UUID identifiers reduces guessability but is not an authorization control; do not accept it as a substitute for a server-side ownership or permission check. |
| Privacy notes | ✓Code review reads source diffs that may contain secrets or proprietary code; keep credentials and sensitive snippets out of review comments and shared logs. | ✓Escalation notes can expose private incident context, customer identifiers, secrets, account IDs, internal topology, or vulnerability details if copied into public PR comments. Use private security channels for embargoed vulnerabilities, secrets, regulated data, and exploit details; keep public PR notes synthetic and minimally revealing. Do not paste raw logs, traces, prompts, database rows, screenshots, or security scan output into review notes unless they have been redacted. | ✓CSRF tokens are security credentials; do not paste real tokens, session cookies, or production request captures into public PR comments or issues. Use synthetic accounts and redacted requests when demonstrating a CSRF proof of concept, and avoid attaching real user identifiers. Be careful that anti-CSRF tokens are not written into URLs, analytics, or logs, where they can leak through referer headers or shared dashboards. | ✓IDOR proof-of-concept testing can expose another account's real data; use synthetic test accounts and synthetic objects rather than real user records when demonstrating the issue. Do not paste real user identifiers, documents, or other objects retrieved during testing into a public PR or issue; redact or replace them with placeholders. Server-side logs and error messages for a denied access attempt should avoid echoing back the unauthorized object's contents, only that access was denied. |
| Prerequisites | — none listed |
|
|
|
| Install | — | — | — | — |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Automate PR review with Claude Code GitHub Actions using official setup steps.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.