Perform a Thorough Code Review on a Pull Request

This prompt turns a model into a senior staff engineer who reviews a raw diff and returns categorized, file-referenced feedback. Reach for it when you want a structured second pair of eyes before merging — especially on PRs where correctness or security matter more than style. The five-category structure forces the model to look past surface formatting and surface the issues that actually break things in production.

What you can expect back

Critical
- src/routes/user.ts:6 — SQL injection. `id` is interpolated directly into the query string. Use a parameterized query: `db.query('SELECT * FROM users WHERE id = ?', [id])`.
- src/auth/middleware.ts:2 — Crash on missing header. `req.headers.authorization` is undefined when no token is sent, so `.split()` throws and returns a 500 instead of 401. Guard it: `const header = req.headers.authorization; if (!header) return res.status(401).end();`

High
- src/auth/middleware.ts:3 — `jwt.verify` throws on an invalid/expired token; wrap in try/catch and return 401 rather than letting it bubble to a 500.

Missing test coverage
- No tests for requireAuth covering: valid token, missing header, malformed token, expired token. Add these before merging.

Style/maintainability
- src/auth/middleware.ts — add explicit types for req/res/next; the implicit `any` weakens the rest of the chain.

Illustrative example — your results will vary by tool and inputs.

Get sharper results

• 01Include a few lines of surrounding context in the diff (use `git diff -U10`) so the model can reason about callers and types, not just the changed lines.
• 02Tell it the language, framework, and runtime up front (e.g. 'Node 20, Express, TypeScript') so security and performance advice is idiomatic rather than generic.
• 03If the PR is large, paste it in logical chunks by file and ask for a final consolidated priority list at the end, so nothing gets truncated mid-review.
• 04Add a line like 'Assume this ships to production handling untrusted user input' to push the model harder on the security category.
• 05Ask it to label each finding with a severity it would actually block the merge on, so you can triage rather than treating all feedback as equal.

Adapt it for your case