Backend Code Review Architecture

3. Error Handling

• Custom error classes with proper HTTP status codes
• Async errors caught and propagated correctly
• No swallowed errors (empty catch blocks)
• Error responses follow consistent format
• Sensitive information not leaked in error messages

4. Security Review

• Input validation on all endpoints
• Authentication middleware applied where needed
• Authorization checks before data access
• No SQL injection vulnerabilities
• Environment variables used for secrets
• CORS properly configured

5. Performance Review

• No N+1 query patterns
• Proper pagination implemented
• Unnecessary data not fetched from database
• Independent async operations parallelized
• Database indexes considered for query patterns

6. Code Quality

• Functions are small and focused (SRP)
• Naming is clear and consistent
• No code duplication (DRY)
• Comments explain "why", not "what"
• Magic numbers/strings extracted to constants

7. Testing

• Unit tests for business logic
• Edge cases covered
• Test names describe behavior, not implementation
• Mocks used appropriately (not over-mocking)

Review Output Format

When reviewing code, provide feedback in this structure:

## Review Summary
- **Overall**: PASS / NEEDS_CHANGES / REJECT
- **Severity**: Info / Warning / Critical

## Findings
### [Category] Finding Title
- **File**: `path/to/file.ts`
- **Line**: 42
- **Severity**: Warning
- **Issue**: Description of the problem
- **Suggestion**: How to fix it