code-review-checklist

name	code-review-checklist
description	Language-agnostic code review guidelines. Adapts conventions to each language's standards.

Code Review Checklist - Agnóstico por Lenguaje

IMPORTANT: This checklist adapts to the language being reviewed. Rule: Follow the conventions of the LANGUAGE, not JavaScript/Java defaults.

---

🔍 Auto-Detección de Lenguaje

Antes de hacer code review, detecta el lenguaje:
├── .py → Python (PEP 8 conventions)
├── .java → Java (Oracle conventions)
├── .cs → C# (Microsoft .NET conventions)
├── .go → Go (Go Code Review Comments)
├── .rs → Rust (Rust API Guidelines)
├── .rb → Ruby (Ruby Style Guide)
├── .ts/.js → JS/TS (Airbnb/Google)
├── .php → PHP (PSR-12)
├── .swift → Swift (Apple conventions)
└── .kt → Kotlin (JetBrains conventions)

---

📋 Quick Review Checklist (Adaptado por Lenguaje)

Correctness (通用的)

• Code does what it's supposed to do
• Edge cases handled
• Error handling in place
• No obvious bugs
• Logic is sound

Security (通用的)

• Input validated and sanitized
• No SQL/NoSQL injection vulnerabilities
• No XSS or CSRF vulnerabilities
• No hardcoded secrets or credentials
• AI-Specific: Protection against Prompt Injection (if applicable)
• AI-Specific: Outputs sanitized before critical sinks

Performance (adaptado por lenguaje)

• No N+1 queries (check ORM patterns)
• No unnecessary loops
• Appropriate caching
• Memory usage reasonable

---

🔴 Naming Conventions by Language

❌ WRONG (assume wrong convention)	✅ CORRECT (follows language)
camelCase in Python	snake_case
snake_case in C#	PascalCase
snake_case in Go (exported)	PascalCase for exported
camelCase in Rust	snake_case

Python Review

# ❌ WRONG
def GetUserById(userId):
    MAX_CONNECTIONS = 100
    user_list = []

# ✅ CORRECT (PEP 8)
def get_user_by_id(user_id: int) -> Optional[User]:
    MAX_CONNECTIONS = 100
    user_list: List[User] = []

C# Review

// ❌ WRONG
public class user_service {
    public int max_connections { get; set; }
    public User get_user_by_id(int user_id) { ... }
}

// ✅ CORRECT (.NET conventions)
public class UserService
{
    public int MaxConnections { get; set; }
    public User GetUserById(int userId) { ... }
}

Go Review

// ❌ WRONG (exporting snake_case)
func get_user_by_id(user_id int) (*User, error) {
    max_connections := 100
    return get_user_by_id(user_id)
}

// ✅ CORRECT (Go conventions)
func GetUserByID(userID int) (*User, error) {
    maxConnections := 100
    return userID, nil
}

---

📋 Code Quality (Language-Agnostic)

DRY - No Repeated Code

• Duplicated logic extracted?
• Reusable functions/modules?

SOLID Principles (Aplicables a todos)

• Single Responsibility?
• Open/Closed?
• Liskov Substitution?
• Interface Segregation?
• Dependency Inversion?

Small Functions

• Functions under 20-30 lines?
• One level of abstraction?
• Few arguments (max 3-4)?

Error Handling

• Exceptions handled?
• Failures logged?
• User-friendly error messages?

---

🔴 Anti-Patterns to Flag (Multi-Language)

Magic Numbers (All Languages)

❌ Wrong	✅ Correct
if status == 3	Named constant
sleep(5000)	Named constant with units

Deep Nesting (All Languages)

// ❌ WRONG
if (a) {
  if (b) {
    if (c) {
      doSomething();
    }
  }
}

// ✅ CORRECT (early return)
if (!a) return;
if (!b) return;
if (!c) return;
doSomething();

Long Functions (All Languages)

❌	✅
100+ lines	Split into smaller functions

Any Type (TypeScript/JavaScript specific)

// ❌ WRONG
const data: any = ...

// ✅ CORRECT
const data: UserData = ...

Type Safety Issues

# Python: ❌ WRONG (no type hints on public API)
def get_user(id):
    return id

# Python: ✅ CORRECT
def get_user(user_id: int) -> Optional[User]:
    return user_id

// Rust: ❌ WRONG 
fn get_user(id) -> Option<User> {
    Some(User { id })
}

// Rust: ✅ CORRECT
fn get_user(user_id: i32) -> Option<User> {
    Some(User { id: user_id })
}

---

🛡️ Security Checklist (Language-Agnostic)

### Input Validation
- [ ] All inputs validated?
- [ ] Sanitized before use?

### Authentication/Authorization
- [ ] Proper auth checks?
- [ ] No auth bypasses?

### Secrets
- [ ] No hardcoded API keys?
- [ ] No passwords in code?
- [ ] Environment variables used?

### SQL Injection
- [ ] Parameterized queries?
- [ ] ORM used properly?
- [ ] No string concatenation in queries?

### XSS
- [ ] Output encoding?
- [ ] Sanitized HTML?
- [ ] CSRF tokens?

---

🧪 Testing Review

Check	Pregunta
[ ] Unit tests added for new code?	Coverage adequate?
[ ] Edge cases tested?	Empty, null, large values?
[ ] Tests readable?	Clear intent?
[ ] Tests isolated?	No dependencies on external state?

---

🔍 Language-Specific Checks

Python

Check	What to look for
Type hints	Public functions should have type hints
PEP 8	Use Black/isort for formatting
Exceptions	Catch specific exceptions, not bare except

C# / .NET

Check	What to look for
PascalCase	All public members PascalCase
var usage	Use var when type is obvious
LINQ	Prefer LINQ over loops for queries

Go

Check	What to look for
Exported/Unexported	PascalCase = exported, snake_case = private
Error handling	Always check errors
Context usage	Pass context for cancellation

Rust

Check	What to look for
Ownership	No unnecessary clones
Error handling	Use Result for fallible functions
lifetimes	Explicit lifetimes where needed

---

📝 Review Comments Guide

// Bloqueadores importantes - 🔴
🔴 BLOCKING: SQL injection vulnerability here

// Sugerencias importantes - 🟡
🟡 SUGGESTION: Consider using useMemo for performance

// Nits menores - 🟢
🟢 NIT: Prefer const over let for immutable variable

// Preguntas - ❓
❓ QUESTION: What happens if user is null here?

// Convenciones de lenguaje - ⚙️
⚙️ CONVENTION: snake_case is used for functions in Python, not camelCase

---

✅ Review Complete Checklist

Check	Question
✅	Naming follows language conventions?
✅	Security issues addressed?
✅	Error handling in place?
✅	Tests added/updated?
✅	No obvious bugs?
✅	Code is maintainable?

---

Remember: A good code review adapts to the language's conventions. Don't enforce JavaScript conventions on Python code, or vice versa. Follow the idioms of the language being reviewed.