Checklist
Code review checklist
What a good review actually checks.
A practical pass for any pull request. It is also the ground a Vetoo agent panel covers automatically, so your team can spend its attention on the judgement calls.
01
Correctness
4 checks- The change does what the ticket actually asked, not just what was easy to implement.
- Edge cases are handled: empty input, nulls, boundaries, the unhappy path.
- No off-by-one, no inverted condition, no error quietly swallowed.
- Concurrency and ordering assumptions still hold under load.
02
Security
4 checks- User input is validated and never concatenated into a query, command or path.
- Auth and access checks run before the sensitive work, not after it.
- Secrets, tokens and personal data are not logged or returned in responses.
- New dependencies are necessary, maintained and trusted.
03
Tests
3 checks- The new behaviour is covered, not just the lines that changed.
- Failure modes have tests, not only the happy path.
- Tests assert behaviour, not implementation detail that will churn next week.
04
Readability and design
4 checks- Names say what they mean, and nothing lies.
- The abstraction fits the problem and does not leak.
- The change is consistent with the patterns already in the codebase.
- Complexity earns its keep; a simpler version would not do.
05
Performance and operability
3 checks- No accidental N+1, unbounded query or hot-path allocation.
- Failure is observable through logs, metrics and useful error messages.
- The change is safe to deploy incrementally and safe to roll back.