Checklist
Pre-merge checklist for AI-generated code
Ten minutes, in this order. The mechanical questions come first so the judgement gets the attention it needs.
Before you read the diff
- You know what the change is meant to do, and what it replaces.
- The automated report is attached, or you ran the code checker yourself.
- You have seen the file list and nothing unexpected is in it.
Security
- No credential, key or private key block in source or examples.
- No eval, Function constructor or HTML assignment reachable from input.
- No SQL, shell command or query string built by concatenation.
- Nothing secret reaches the browser bundle.
Correctness
- No empty catch block, no default returned in place of an error.
- One realistic failure path traced end to end, from event to what the user sees.
- Every new dependency exists at the installed version.
- The operation is safe to run twice (retry, double submit, second tab).
Boundaries
- Authorisation checked on the handler and failing closed on error.
- Money, deletion and invites have a confirmation and a recovery path.
- A test exists for anything that touches money, permissions or deletion.
Sign-off
- Approval states the scope: what was reviewed and what was not.
- The automated report is linked from the pull request.
Sign-off
Reviewer
Date
Version reviewed
Record what was reviewed and what was not. An accepted finding is a decision, so write the reason next to it.
Automate the repeatable half
The list stays useful. The console makes it fast.
Run the same checks on the file before you walk the list by hand.