# Senior-Level Code Review & Refactor Plan

Get a structured senior-engineer-style code review covering correctness, performance, security, and maintainability, ending in a prioritized refactor plan.

## Prompt

Act as a senior software engineer conducting a thorough code review. Review the following code written in {{programming_language}}. Structure your review in this exact order:

1. Correctness — identify any logical bugs, edge cases not handled, or incorrect assumptions.
2. Security — flag any vulnerabilities (e.g. injection risks, unsafe deserialization, missing input validation, secrets handling).
3. Performance — identify inefficiencies (e.g. unnecessary loops, N+1 queries, unneeded allocations) and estimate their real-world impact.
4. Maintainability — comment on naming, structure, duplication, and testability.
5. Prioritized refactor plan — list the top 5 changes ranked by impact vs. effort, and provide corrected code snippets for the top 2.

Do not rewrite the entire file. Focus on the highest-impact issues only.

Code:
```{{programming_language}}
{{code_block}}
```

## Best for

Developers and engineering leads who want a thorough, prioritized code review rather than a surface-level style pass, especially before a merge or release.

## Compatible tools

- Claude
- ChatGPT

## How to use

- Replace {{programming_language}} with the language of your code (e.g. Python, JavaScript, Go).
- Paste the specific function or module you want reviewed into {{code_block}} — keep it focused rather than pasting an entire large file.
- Read through the review in order; correctness and security issues should be fixed before performance or style issues.
- Apply the top 2 corrected snippets first, then address the remaining items in the prioritized list.

## Customization tips

- Add context about the code's environment (e.g. 'this runs in a high-traffic production API') so performance and security assessments are calibrated correctly.
- Ask for a stricter review if the code handles sensitive data (PII, payments, auth).
- Request the review in a specific format (e.g. as inline comments) if you want to paste it directly into a pull request.

## Example input

Act as a senior software engineer... Code:
```python
def get_user(user_id):
    query = "SELECT * FROM users WHERE id = " + user_id
    result = db.execute(query)
    return result
```

## Example output

1. Correctness — the function assumes user_id is always a valid, existing ID; no handling for a missing user, which will silently return an empty result rather than raising a clear error.
2. Security — this is a SQL injection vulnerability; user_id is concatenated directly into the query string instead of using parameterized queries.
3. Performance — SELECT * retrieves all columns even if only a subset is needed downstream, increasing payload size unnecessarily.
4. Maintainability — no type hints or docstring; unclear what 'result' returns (single row vs list).
5. Prioritized refactor plan: (1) Fix SQL injection via parameterized query [highest impact, low effort], (2) Add explicit not-found handling, (3) Select only needed columns, (4) Add type hints and docstring, (5) Add unit test for missing user case.
Corrected code:
```python
def get_user(user_id: int) -> dict | None:
    query = "SELECT id, name, email FROM users WHERE id = %s"
    result = db.execute(query, (user_id,))
    return result[0] if result else None
```