AI Code Review — Catch Bugs Before They Ship

Code review is time-consuming but critical for quality. AI code review does not replace human reviewers — it handles the mechanical parts (spotting obvious bugs, security patterns, style violations) so human reviewers can focus on architecture and business logic. This guide shows you the tools and prompts that actually work.

What You'll Learn

• Using Claude for comprehensive PR review with a diff
• GitHub Copilot's native PR review features
• Security scanning with AI
• Enforcing coding standards automatically
• Ready-to-use PR review prompt templates

Using Claude for PR Review

Claude is excellent for deep code review because of its large context window (200K tokens) and precise instruction following. The workflow:

Step 1: Get the diff

git diff main...feature-branch
# Or for a specific PR:
git show --stat HEAD
git diff HEAD~1 HEAD

Step 2: Paste to Claude with a structured prompt

Please review this PR diff for production readiness.

Context: This is a Next.js 15 application with TypeScript strict mode.
The PR adds user authentication using JWT tokens.

Diff:
[paste your full git diff here]

Review for:
1. Security issues (JWT handling, input validation, SQL injection risks)
2. TypeScript correctness (no implicit any, proper type safety)
3. Error handling completeness (all async operations have try/catch)
4. Performance issues (N+1 queries, unnecessary re-renders)
5. Code style consistency with the existing codebase

Format your review as:
- CRITICAL: Must fix before merge
- MAJOR: Should fix before merge
- MINOR: Can fix in follow-up
- SUGGESTION: Optional improvement

Why this works: Structured format + severity levels makes the review actionable. Claude does not just list issues — it categorizes them so you know what to prioritize.

🇮🇳 India Note: For financial applications in India (banking, payments, mutual funds), add GST calculation correctness and DPDP Act compliance to the review checklist. Claude can check whether your code handles personal data according to basic data minimization principles.

Ready-to-Use Review Prompts

Security-Focused Review

Security review of this code. Focus on:
- SQL injection vulnerabilities (is user input ever used directly in queries?)
- XSS vulnerabilities (is user input rendered as HTML anywhere?)
- Authentication bypass possibilities (are all routes properly protected?)
- Sensitive data exposure (passwords, tokens, API keys in logs or responses?)
- IDOR vulnerabilities (does the code check that the user owns the resource they are accessing?)
- Input validation gaps

Diff:
[paste diff]

Performance Review

Performance review focused on database queries and API efficiency:
- N+1 query problems (loading a list then querying in a loop)
- Missing database indexes for new query patterns
- Unnecessary data fetching (selecting * when only a few fields are needed)
- Caching opportunities
- Bundle size impact of new dependencies

Diff:
[paste diff]

TypeScript/Types Review

TypeScript quality review:
- Find any uses of `any` type (list each occurrence with line number)
- Identify places where the return type is implicit (should be explicit)
- Find cases where null/undefined are not properly handled
- Check that error handling uses typed errors, not unknown
- Identify interfaces that could benefit from being more specific

Diff:
[paste diff]

India-Specific Business Logic Review

Review this payment/financial code for correctness:
- GST calculation: verify rates are correct (18% services, verify others)
- Amount formatting: ensure Indian number format (lakhs, crores)
- Currency: all amounts should be in paise (smallest unit) internally, converted for display
- UPI: validate UPI ID format before sending to payment gateway
- PAN/Aadhaar: verify not stored beyond what UIDAI guidelines allow

Diff:
[paste diff]

GitHub Copilot Native PR Review

GitHub Copilot has built-in PR review capabilities (available on Copilot Enterprise and Copilot Pro):

How to trigger:

1. Open a pull request on GitHub
2. In the conversation thread, look for the "Review with Copilot" button
3. Copilot reviews the PR and adds inline comments to specific lines
4. Comments include suggested fixes as code snippets

Copilot PR review strengths:

• Inline comments attached to specific lines (easy to address)
• One-click to apply suggested fixes
• Context-aware (knows the file type and framework from the repo)
• Integrates with existing PR workflow

Copilot PR review limitations:

• Less thorough than Claude with a detailed prompt
• Focuses more on obvious issues than architectural problems
• Better for individual file changes than system-wide impact analysis

AI Security Scanning

For systematic security scanning beyond individual PR review:

Full codebase security audit:

Conduct a security audit of this codebase.
Primary language: Python/FastAPI

Look for these vulnerability categories:
1. Injection vulnerabilities (SQL, command, LDAP)
2. Broken authentication (weak token generation, session fixation)
3. Sensitive data exposure (credentials in code, logs, API responses)
4. XML External Entity (XXE) if XML is parsed anywhere
5. Broken access control
6. Security misconfiguration (debug mode, weak defaults)
7. Insecure deserialization

Relevant files: @file:api/routes/ @file:api/models/ @file:api/middleware/

List findings with: location, vulnerability type, risk level (Critical/High/Medium/Low), and suggested fix.

Automated security tools to use alongside AI:

• Semgrep — free, open-source, runs in GitHub Actions. Finds OWASP Top 10 issues automatically.
• Bandit — Python security linter, free, finds common Python security issues
• ESLint security plugin — JavaScript security rules

AI code review works best alongside automated tools — AI handles logic and context, automated tools handle pattern matching at scale.

Enforcing Coding Standards

Rather than reviewing for style manually, use AI to check standards compliance:

Standards check prompt:

Check this code against our team standards. Our standards are:
@file:.cursorrules (or paste the rules directly)

Specifically verify:
- All functions have explicit return type annotations
- No console.log statements remain (should use our logger utility from lib/logger.ts)
- All async functions have proper error handling
- Component files follow the naming convention in our standards
- No magic numbers (should be named constants)

List violations with file:line format.

Practical Code Review Workflow

For a team using GitHub + Cursor/Claude:

1. Automated: Semgrep in GitHub Actions catches security patterns on every PR
2. Copilot inline: Quick review during code reading, catches obvious issues
3. Claude deep review: For complex PRs or security-sensitive changes, use the structured prompt approach
4. Human review: Focus on architecture, business logic, team standards — things AI misses

This layered approach means human reviewers spend their time on high-value analysis rather than hunting for missing null checks.

💰 Free Deal: Claude's free tier (daily limit) is sufficient for reviewing several PRs per day. For a team of 3-5 developers where you review 2-3 PRs daily, the free tier is adequate. Larger teams should consider Claude Pro or API usage.

Official Resources

• Claude.ai — Claude for comprehensive PR review
• GitHub Copilot PR Review — Native Copilot PR review docs
• Semgrep — Free automated security scanning
• OWASP Code Review Guide — Security review checklist
• Conventional Comments — Structured comment format for reviews