Free to read · no account needed

15 min · code

Code review checklist with Claude

Goal: get a severity-ranked review of a diff focused on correctness—not style nits.

Best for: Claude chat or Claude Code-style workflows. You still run tests and own the merge.

Use AI as a checklist buddy—not an autopilot merger. You still run tests.

Why beginners skip this

Asking Claude to “look at this diff” without severity order wastes the review. Style nits crowd out blockers when you skip a ranked checklist.

Habit this week (Asia/Shanghai): paste one real diff and demand blocker / major / nit—reject invented file names; date the ranked list.

What to paste

  • The diff (or changed files), not the whole repo if avoidable
  • How to run tests / expected behavior
  • Your definition of “blocking” 
Goal: Review this diff for correctness bugs that could break production.
Ignore: formatting, import order, comment taste—unless they hide a bug.
Report format:
## Blocking
- [file:line] issue · why · suggested fix direction

## Non-blocking
- ...

## Questions for author
- ...
Boundaries: Do not rewrite the entire file. Quote the risky snippet. If unsure, ask a question instead of asserting.
How to verify: [test command or manual steps]

Diff:
---
[paste]
---

Second pass — security & edges

Example

Filled prompt

Goal: Review this diff for correctness bugs that could break production.
Ignore: formatting, import order—unless they hide a bug.
Report: Blocking / Non-blocking / Questions for author
How to verify: npm test && curl -i localhost:3000/api/orders
Diff: (auth middleware now skips JWT check when header X-Debug=1)

What good output looks like

  • Blocking flags the debug bypass as ship-stopper
  • Quote shows the risky if-branch
  • Questions ask whether X-Debug is stripped in prod
  • Pass/fail dated (Asia/Shanghai) sits next to the artifact
From the same diff, list only: authz mistakes, injection risks, secret leakage, and unchecked external input.
If none, say “None found in provided diff” — do not invent.

Make Claude verify

Example

Filled prompt

Diff adds logging of Authorization headers "for debug."
Rank Blocker if secret leakage. Demand fix idea. Nits after blockers.

What good output looks like

  • Lists the debug header as authz mistake
  • Does not invent SQL injection if none in diff
  • Empty categories say “None found”

If you use an agentic coding setup, prefer a fresh review context so it is not biased by the authoring chat. Give it the same checklist. Run your test suite yourself.

Propose 3 regression tests (names + assert idea) for the Blocking items. Do not implement unless I ask.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Close the loop

After Practice now, write one line: what you will refuse next time. That line is the habit.

Example

Filled prompt

Diff logs Authorization header "temporarily."
Blocker for secret leakage + fix idea. Nits after.
Context: real workstream this week (Asia/Shanghai). Name actual files/people.
Constraints: no invented metrics/owners/prices; label Unknowns; stop before send/delete/pay.
Done check: I can mark pass/fail in one minute on the output.

What good output looks like

  • Pulls from Project/file named in the ask for “Code review checklist with Claude”
  • Standing instructions respected; no silent scope creep
  • Decisions quoted or labeled Unclear — never “sounds good”
  • One-minute check: does output match claude-code-review-checklist Done?

Red flag

Approving without tests discussed; permission widening unnamed; merging when you cannot state the risk—withdraw.

Save this card

Card: paste real diff → demand blocker / major / nit → reject invented paths. Severity before style.

1. What I shipped: ___ 2. What I refused: ___ 3. What I will never-do again: ___ (date: Asia/Shanghai)

  • [ ] Tools/writes paused
  • [ ] Refuse-line dated
  • [ ] Artifact path saved
  • [ ] Next link chosen (or stop)

Before you start

Open the Claude Project (or new chat) you will keep. Confirm the knowledge file or standing instructions for “get a severity-ranked review of a diff focused on correctnes” are the ones you mean—not last month’s paste Guide: claude-code-review-checklist Keep the live artifact visible; a blank practice box means stop and fetch the real job first

  • Goal in one line: ___
  • Allowed tools: ___
  • Forbidden: ___
  • Human approve needed for: ___

How to use this week

This week in Claude: paste one real diff and demand a severity-ranked review (blocker/major/nit). Reject invented file names. Save the ranked list on a live artifact—not a blank demo. Write one refuse-line and date the note (Asia/Shanghai). If you only skimmed claude-code-review-checklist, put 25 minutes on the calendar and redo once.

Close the week by quoting aloud the refuse line you actually used once. If you cannot, rerun Practice now and date the pass/fail (Asia/Shanghai).

Pitfalls

Example

Filled prompt

Diff: auth session refresh returns 500 when token expired at midnight UTC.
Severity-ranked review: Blocker/Major/Nit. Each Blocker needs a repro idea.
Ignore comma nits until blockers empty.

What good output looks like

  • Names like rejects_request_when_x_debug_set_in_prod
  • Assert idea is clear; no full test file dumped
  • You still run the suite yourself
PitfallFix
“LGTM” with no criteriaPaste the checklist above
Reviewing generated code you never ranRun tests first
Asking for a full rewriteAsk for findings + direction

Field note: on one real PR today, refuse merge until correctness, tests, permissions, and readability each have a written yes/no. Date the checklist (Asia/Shanghai).

Practice now

Live card: review a real PR/diff with correctness/tests/permissions/readability—approve or request changes only (Asia/Shanghai).

Today: review one real diff with a checklist: correctness, tests, permissions, readability. Approve or request changes only after all four. Date it (Asia/Shanghai).

Today card (copy) — claude-code-review-checklist: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

  • [ ] Artifact path written
  • [ ] Refuse example would say "yes"
  • [ ] Dated Asia/Shanghai

One sentence takeaway

Paste a real diff and demand blocker / major / nit—reject invented files. This week: save one ranked review dated (Asia/Shanghai).

Next

Code path · Compare models · Claude Projects · Minimal repro · Coding agent boundaries

Pair with today: open the first Next link (path-code) only after you dated a refuse-line for this guide (Asia/Shanghai).

← Back to home · Learn · Tools · Compare · Start