Code Review

What to look for beyond correctness.

Choose a concept, then work through an example

8 guides in this section. Each article states its audience and assumptions, explains specialized terms, and gives a worked example or practical exercise.

Technical topics distinguish toy models from product behavior. Leadership topics distinguish context-dependent frameworks from evidence and personal claims.

01·Beyond Correctness — Review PhilosophyReview intent, correctness, maintainability, and operational/security risk with a proportionate attention budget. 02·Performance, Scalability & ReliabilityReview costs and failure amplification against the actual workload rather than optimizing by intuition. 03·Correctness in Distributed & Concurrent CodeReview replay, races, partial failure, and ordering at the effect's actual transactional boundary. 04·API, Schema & Query CompatibilityReview binary, schema, and semantic compatibility across old/new readers and writers. 05·Observability & OperabilityReview whether a new behavior can be detected and explained without unsafe or excessive telemetry. 06·Privacy & ComplianceReview data purpose, minimization, access, retention, and deletion with an explicit privacy owner. 07·Pushing Back on a DesignDisagree on a design using a shared problem, evidence, alternatives, and clear decision authority. 08·Reviewing a Security-Critical ChangeReview threats, object-level authorization, input boundaries, retries, and rollout before trusting a transaction path.

Find a guide

8 guides

Reviewing API, Schema & Query Compatibility

Review binary, schema, and semantic compatibility across old/new readers and writers.

Schema compatibility and semantic contracts · Expand-contract migrations · Ownership, accountability, and decision rights · Preconditions and postconditions · Outputs, outcomes, and measurement

Reviewing Correctness in Distributed & Concurrent Code

Review replay, races, partial failure, and ordering at the effect's actual transactional boundary.

Idempotency keys · Offsets and checkpoints · Transactional outbox · Optimistic concurrency and compare-and-set · Fencing tokens

Reviewing for Observability & Operability

Review whether a new behavior can be detected and explained without unsafe or excessive telemetry.

SLIs, SLOs, and error budgets · Burn-rate alerting · Cardinality · Spans and trace context · Outputs, outcomes, and measurement

Reviewing for Performance, Scalability & Reliability

Review costs and failure amplification against the actual workload rather than optimizing by intuition.

Complexity and workload assumptions · Backpressure and load shedding · Outputs, outcomes, and measurement · Event loops and nonblocking I/O · Preconditions and postconditions

Code Review Beyond Correctness

Review intent, correctness, maintainability, and operational/security risk with a proportionate attention budget.

Preconditions and postconditions · Decision records and reversible experiments · SBI feedback and observable behavior · Outputs, outcomes, and measurement · Ownership, accountability, and decision rights

Reviewing for Privacy & Compliance

Review data purpose, minimization, access, retention, and deletion with an explicit privacy owner.

Privacy, minimization, and pseudonymity · Authentication, authorization, and IDOR · Schema compatibility and semantic contracts · Ownership, accountability, and decision rights · Frameworks versus empirical evidence

Pushing Back on a Design or Implementation

Disagree on a design using a shared problem, evidence, alternatives, and clear decision authority.

Decision records and reversible experiments · Stakeholders and alignment · SBI feedback and observable behavior · Ownership, accountability, and decision rights · STAR and CARL interview structure

Reviewing a Security-Critical Change

Review threats, object-level authorization, input boundaries, retries, and rollout before trusting a transaction path.

Authentication, authorization, and IDOR · Privacy, minimization, and pseudonymity · Idempotency keys · Optimistic concurrency and compare-and-set · Preconditions and postconditions