Strict code review of a diff
A review prompt that reports only what would break in production, gives the smallest fix for each finding, and is allowed to say the diff is fine.
Review the diff below as a senior engineer on this codebase.
Only report issues that would break behaviour, leak data or fail in production. Skip style opinions.
For each issue give: the file and line, what breaks, and the smallest edit that fixes it.
If the diff is fine, reply with one line saying so.
--- diff ---
{{diff}}Fill these in
| Placeholder | What goes here | Example |
|---|---|---|
| {{diff}} | Unified diff | git diff main...HEAD |
Notes from the author
The last rule is what makes this usable. Without an explicit way to report nothing, models invent findings to fill the answer. On smaller local models, drop that rule and review one file per call - they follow four constraints less reliably than hosted models.
Worked example
A twelve-line diff adding a user lookup without checking the session owner.auth/session.php:41 - the lookup uses the id from the request instead of the session, so any logged-in user can read another account. Smallest fix: replace $_GET['id'] with $_SESSION['user_id'].Tagged