Code Review Checklist for Beginners — 20 Things to Check
A code review checklist ensures you never miss critical issues in pull requests. This 20-point checklist covers everything from security vulnerabilities to documentation — organized by priority so you check the most important things first.
What is a code review checklist?
A code review checklist is a structured list of questions to ask about every code change before it merges. Without a checklist, reviews are inconsistent — senior developers catch different things than juniors, and everyone misses things under time pressure. A checklist levels the playing field.
🔴 Security checks (check first — highest risk)
These 5 issues can cause data breaches. Always check security before anything else.
□ SQL injection risk?
Does any database query concatenate or format user input? Use parameterized queries only.
□ XSS risk?
Is user input rendered in HTML without sanitization? Use textContent or DOMPurify.
□ Secrets in code?
Any API keys, passwords, or tokens hardcoded? Should use environment variables.
□ Input validated?
Is all user input validated for type, length, and format before processing?
□ Authentication/authorization?
Does every protected endpoint verify the user has permission?
🟡 Bug checks (runtime correctness)
These issues won't cause security breaches but will cause incorrect behavior in production.
□ Null/undefined checks?
Are values that could be null/undefined checked before access?
□ Error handling?
Are exceptions caught? Are async errors handled? Is error state shown to users?
□ Edge cases covered?
Empty arrays, zero, negative numbers, very long strings — tested?
□ Off-by-one errors?
Are loop bounds correct? Are array indices within range?
□ Race conditions?
In async code, can two operations interfere if they run simultaneously?
🟢 Code quality checks (maintainability)
These don't cause immediate bugs but make future bugs more likely.
□ Function size
Is any function longer than 50 lines? Should be split.
□ Naming clarity
Do variable/function names describe what they contain/do?
□ Dead code
Is there commented-out code, unused variables, or unreachable branches?
□ Duplicate logic
Is the same logic repeated in multiple places? Should be extracted.
□ Magic numbers
Are numbers like 86400 or 0.05 unexplained? Should be named constants.
📝 Documentation & tests
The last 5 checks — less urgent but important for team velocity.
□ Tests added?
Does the PR include tests for the new behavior? Are edge cases tested?
□ Comments updated?
If behavior changed, are comments and docs updated to match?
□ README updated?
If new setup steps or env vars are required, is README updated?
□ PR description clear?
Does the PR explain WHAT changed and WHY? Easy to review and revert?
□ No debug code?
No console.log, print(), or temporary test code left in?
Pro tip: Use LearnCodeGuide to automate the first 5 security checks before every PR. It takes 10 seconds and eliminates the most critical review category entirely. Let AI handle security so you can focus your review time on business logic.
Automate Your Security Checklist
Paste your code — LearnCodeGuide detects all these issues automatically using GPT-4o + Claude Sonnet. Free to start.
Analyze Your Code →Related Guides
Published by LearnCodeGuide Team · Last reviewed: October 2025