Skip to content
← Back

Phase 5 of 6 · Automated review before each pull request

Secure

The branch is checked against 12 criteria. Findings are fixed, or reported as open, before shipping.

  1. 01Spec match
  2. 02Scope and size
  3. 03Readability and conventions
  4. 04Tech debt
  5. 05Unit tests
  6. 06E2E tests
  7. 07Security
  8. 08Cyclomatic complexity
  9. 09Error handling and edge cases
  10. 10Performance
  11. 11Backward compatibility
  12. 12Documentation

What each criterion checks

A criterion is rated only when the change touches what it checks: a color change has no logic to unit test.

01 Spec match
The branch does what the issue, the design doc and the plan asked for. Each requirement is marked done, partial, missing or contradicted.
02 Scope and size
The change stays within what was asked, with no unrelated refactor mixed in, and is small enough to review in one sitting.
03 Readability and conventions
The code reads clearly and follows the project's own patterns, naming and style, such as its design tokens and lint rules.
04 Tech debt
No shortcuts left behind: duplicated logic, dead code, skipped tests, disabled rules or new TODO, FIXME and HACK comments.
05 Unit tests
New or changed logic (branches, calculations, data transformation, state) has tests that assert the new behavior, not only run it.
06 E2E tests
A changed flow (navigation, forms, interactions, what an API client sees) is covered end to end.
07 Security
Input, auth, permissions, data access, network calls, secrets and dependencies are handled safely, with no sensitive data logged.
08 Cyclomatic complexity
New or changed functions do not pile up branches. Complexity is measured with the project's tools when it has them.
09 Error handling and edge cases
Code that can fail (I/O, parsing, user input, external calls) handles the failure and the edge cases.
10 Performance
Paths that scale with data or traffic (queries, loops, list rendering, payloads, bundle size) do not get slower.
11 Backward compatibility
Public APIs, schemas, migrations, config and env keys, event payloads, URLs and CLI flags keep working for whoever depends on them.
12 Documentation
Changes to behavior, setup, config or a public API are reflected in the docs.