Pull request code review

Correctness first, then everything else

Your AI reviews a diff the way a senior engineer would: intent first, then correctness and edge cases, security and data handling, migrations, tests, and maintainability, with labeled findings, suggested code and a clear merge call.

By Vander Labs. A Vander Labs Original, written by the Vander Labs team with AI assistance. Works with Claude, ChatGPT, Cursor and Claude Code.

What your AI learns

• Traces a happy path and a failure path through the change
• Labels findings as blocker, should fix, suggestion, question or praise
• Writes the missing tests and the suggested code, not just the complaint

How it works

1. Understand intent: Description, issue and file list read first; the change summarized in one sentence and sized.
2. Correctness: Nulls, boundaries, error paths, concurrency, time zones, money math and cleanup, in logical file order.
3. Security and data: Validation at trust boundaries, injection, authorization on every new endpoint, secrets and personal data in logs.
4. Data and compatibility: Reversible non-locking migrations, deploy order with old code running, versioned API changes, safe flag defaults.
5. Tests: Behavior tests for the new path and the fixed bug, deterministic, with missing cases written as code.
6. Design and maintainability: Fit with existing patterns, naming, size, dead code and duplication, kept as suggestions unless they hide bugs.
7. Performance: N+1 queries, unbounded loops, missing indexes and hot-path blocking, raised only with a reason.
8. Write the review: Summary, labeled findings with file and line and suggested code, tests to add, and the merge recommendation.

Limits and safety

• Security and migration findings are never rated below should fix.
• Any blocker means request changes; the recommendation always matches the findings.

Topics: code-review, pull-request, security, testing, engineering