Skip to content

Code comprehension and MR / code review

Reading code you didn't write and reviewing merge requests: defect scans, async and security lenses, test gaps, and clear review comments.

10 lessons

Reading code you didn't write

  1. 1Entry-point-first readingFind the doors, walk one real request through, and read only what it touches.
  2. 2Explain line NWhat it does, the case it protects, and the input that breaks without it.

Finding defects

  1. 3Defect taxonomy scanOne pass per bug class, each with the input that triggers it; the MR's green tests clear none of them.
  2. 4Async and race defectsA handler is atomic only between its awaits: find the gap between a check and its write, and let the shared store close it.
  3. 5Security lens in reviewA guard says who is calling; the review asks whose data, which input, what leaks and what repeats.
  4. 6Performance lens in reviewAsk what each change costs at production's size; post only what grows, with the count that proves it.
  5. 7Test-gap analysisA test counts only for the changes it would fail on; plant the change and run.

Writing and delivering the review

  1. 8Review order and the verdictRead first what could throw the most work away; approve when the code is better than main, not when it is perfect.
  2. 9Severity-tagged review commentsLabel every comment; block only what a run proves; give the author the impact and the change.
  3. 10Live walkthrough and improving the MRPresent by counted impact, fix by value per minute: spend the call's minutes where they remove the most harm.