## Code Review: {file/component}
 
### Summary
{1-2 sentence overall assessment}
 
### 🔴 Critical Issues
{Must fix before merge}
 
#### Issue 1: {Title}
-**Location**: `file.py:42`
-**Problem**: {Description}
-**Impact**: {Security/correctness impact}
-**Fix**: {Suggested solution}
 
### 🟡 Suggestions
{Should consider fixing}
 
#### Suggestion 1: {Title}
-**Location**: `file.py:88`
-**Current**: {What it does now}
-**Suggested**: {Better approach}
-**Reason**: {Why this is better}
 
### 🟢 Positive Notes
{Good patterns to highlight}
 
-Good use of {pattern} at `file.py:100`
-Clear error handling in {function}
 
### Verdict
-[ ] ✅ Approve
-[ ] 🔄 Request Changes
-[ ] 💬 Needs Discussion

# 🔴 SQL Injection
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # BAD
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))  # GOOD
# 🔴 Command Injection
os.system(f"ls {user_input}")  # BAD
subprocess.run(["ls", user_input], check=True)  # GOOD
# 🔴 Path Traversal
open(f"/data/{user_filename}")  # BAD
safe_path = Path("/data") / user_filename
if safe_path.resolve().is_relative_to(Path("/data")):  # GOOD
    open(safe_path)

// 🔴 XSS
element.innerHTML = userInput;  // BAD
element.textContent = userInput;  // GOOD
// 🔴 Prototype Pollution
Object.assign(target, JSON.parse(userInput));  // BAD
// Validate shape before merging
// 🔴 SSRF
fetch(userProvidedUrl);  // BAD
// Validate URL against allowlist

# 🔴 N+1 Query
for user in users:
    orders = db.query(Order).filter(Order.user_id == user.id).all()  # BAD
# ✅ Eager Loading
users = db.query(User).options(joinedload(User.orders)).all()  # GOOD
# 🔴 Repeated Computation
for item in items:
    expensive = calculate_expensive_thing()  # BAD (repeated)
    process(item, expensive)
# ✅ Cache Result
expensive = calculate_expensive_thing()  # GOOD (once)
for item in items:
    process(item, expensive)

# View changes in a PR
git diff main...HEAD
 
# Check specific file
git diff main -- path/to/file.py
 
# View commit history
git log --oneline main..HEAD
 
# Check for secrets (use git-secrets or similar)
git secrets --scan