enterprise-pr-review

name	enterprise-pr-review
description	Reviews Pull Requests applying enterprise-grade criteria: SOLID principles, security, performance, testability, naming conventions, and team consistency. Use when asked to review code, audit a PR, check a diff for issues, or evaluate code quality in any backend language. Stack-agnostic: works with .NET, Laravel, Java, Node.js, and others. Provides structured feedback with severity levels.
license	MIT
metadata	{"author":"iamBrzDev","version":"1.0"}

When to activate

• "Review this code / PR / diff"
• "What do you think about this implementation?"
• "Check this for issues before I merge"
• "Does this follow best practices?"
• Any code pasted with the expectation of feedback

Review Framework

Analyze across 6 dimensions. Use severity: 🔴 Blocker · 🟡 Warning · 🔵 Suggestion

1. Correctness & Logic

• Does the code do what it's supposed to?
• Edge cases: null inputs, empty collections, concurrent access
• Error paths handled?

2. Security

• User input in raw SQL, shell commands, or file paths?
• Protected endpoints actually protected?
• Secrets, keys, or PII logged or exposed in responses?

🔴 Raw SQL with string interpolation
🔴 API endpoint without auth check
🔴 Password or token in response body
🟡 User-controlled data in file path without sanitization
🟡 Auth check without ownership check

3. Performance

• N+1 query patterns?
• Missing pagination on large result sets?
• Blocking I/O where async applies?

4. Design & SOLID

• Single Responsibility: does this class/method do one thing?
• Dependency Inversion: dependencies injected or hardcoded?
• Names accurately reflect behavior?

5. Testability

• Can this be unit tested without a DB or HTTP server?
• Dependencies injectable?

6. Team Consistency

• Follows established patterns in this codebase?
• Same naming conventions and error handling?

Output Format

## PR Review

### Summary
Brief description and overall assessment.

### Blockers 🔴
1. [File:Line] Problem description and why it matters.
   **Fix:** Concrete suggestion.

### Warnings 🟡
### Suggestions 🔵

### What's done well ✅
At least one specific thing done right.

Non-negotiables — always 🔴

• User input in raw SQL without parameterization
• Missing auth/authz on protected resources
• Secrets or PII in logs or API responses
• Swallowed exceptions with empty catch blocks
• Hardcoded credentials in code

Tone

Direct but constructive. Reference file:line specifically. Explain why, not just what. Assume good intent.