Skip to content
Programming & DevelopmentAdvanced

Structured Code Review With Prioritized Findings

Get a senior-level review of a code change, with issues ranked by severity and concrete suggested fixes.

Share on X (opens in a new tab)Share on LinkedIn (opens in a new tab)

Make it yours

Fill in each variable and watch the prompt update. Anything still in {{braces}} needs your input before you use it.

Fill in the blanks

0 of 5 filled

Language or stack.

What the change is meant to do.

Conventions, constraints, libraries in use.

What to pay most attention to.

The code or diff to review.

Live previewUnfilled
Act as a senior {{language}} engineer doing a code review for a teammate.

Purpose of this change: {{change_purpose}}
Project context and conventions: {{project_context}}
Focus areas: {{focus_areas}}

Review the code below. Return your findings in this format:

**Summary** — 2 sentences: overall assessment and whether it's ready to merge.

**Findings** — a table with columns: Severity (Blocker / Major / Minor / Nit), Location, Issue, Suggested fix.
Order by severity. Only include real issues — do not pad the list. If you're unsure whether something is a problem, mark it "(uncertain)" and say why.

**What's done well** — 1–3 specific points.

Do not rewrite the whole file. Show code only for fixes that are hard to describe in words.

Code:
"""
{{code}}
"""
Open in Playground

Example

Example input

Filled prompt
Act as a senior Node.js / Express engineer doing a code review for a teammate.

Purpose of this change: Adds an endpoint that lets a logged-in user update their email address.
Project context and conventions: Postgres via the pg library. Auth middleware sets req.user. We return JSON errors as { error: string }.
Focus areas: security, input validation, and error handling

Review the code below. Return your findings in this format:

**Summary** — 2 sentences: overall assessment and whether it's ready to merge.

**Findings** — a table with columns: Severity (Blocker / Major / Minor / Nit), Location, Issue, Suggested fix.
Order by severity. Only include real issues — do not pad the list. If you're unsure whether something is a problem, mark it "(uncertain)" and say why.

**What's done well** — 1–3 specific points.

Do not rewrite the whole file. Show code only for fixes that are hard to describe in words.

Code:
"""
app.put("/users/:id/email", auth, async (req, res) => {
  const { email } = req.body;
  await db.query(`UPDATE users SET email = '${email}' WHERE id = ${req.params.id}`);
  res.json({ ok: true });
});
"""

Example output

Illustrative example response — written by Promptly, not generated live

Summary: The endpoint works for the happy path but has two security blockers. Not ready to merge.

Findings

SeverityLocationIssueSuggested fix
Blockerdb.query lineSQL injection: email and id are inserted directly into the SQL string.Use parameters: db.query("UPDATE users SET email = $1 WHERE id = $2", [email, id]).
BlockerRoute handlerAny logged-in user can change any user's email by changing :id.Check req.params.id === String(req.user.id) (or drop :id and use req.user.id); return 403 otherwise.
Majorreq.bodyNo validation: missing or malformed email is saved.Validate format and length; return 400 with { error }.
MajorWhole handlerDatabase errors are unhandled, so failures may hang or leak details.Wrap in try/catch and return 500 with { error: "Could not update email" }.
MinorResponseDuplicate emails (uncertain — depends on a unique constraint) would surface as a raw DB error.Catch the unique-violation error and return 409.

What's done well

  • Auth middleware is applied to the route.
  • Small, single-purpose handler that's easy to follow.

Why it works

  • Purpose and project context let the model judge the code against what it's meant to do and your team's conventions, not generic best practices.
  • Severity ranking in a table makes the review actionable: you fix blockers first instead of wading through nits.
  • "Do not pad the list" and "(uncertain)" counter two common AI review failures — inventing problems to seem thorough, and stating guesses as facts. Always verify findings yourself; AI reviews complement, not replace, human review and tests.

Techniques used