Code Review learning path: everything to study, topic by topic

Principles of an effective code review: what reviewers should focus on, the difference between style and correctness, and how to prioritize review effort.

PR size best practices, description requirements, review turnaround expectations, and how poor PR workflow undermines review quality.

How to write review comments that are specific, actionable, and respectful. The difference between feedback that improves code and feedback that creates conflict.

How to calibrate the scope of a review to the change — when to do a full architecture review vs. a quick sanity check, and how to avoid both under- and over-reviewing.

The mental model of an effective reviewer: thinking about future maintainers, verifying intent vs. implementation, and the reviewer's responsibility in the development process.

Building healthy code review culture: constructive feedback frameworks, psychological safety, and reducing review anxiety

Measuring code review effectiveness: cycle time, review coverage, feedback quality metrics, and continuous improvement

Recognizing common code smells in PRs: long methods, duplicate code, feature envy, data clumps, primitive obsession, and when they matter.

The trade-off between clever, compact code and readable, maintainable code. How AI tools tend toward over-engineered or unnecessarily complex solutions.

Reviewing variable, function, and class names for clarity and precision. Identifying poor abstractions, leaky abstractions, and naming that obscures intent.

Understanding and applying cyclomatic complexity in code review. Identifying high-complexity functions, deeply nested logic, and when complexity is a blocking concern.

Evaluating test coverage in PRs — identifying missing tests, tests that only test the happy path, tests that test implementation rather than behavior, and coverage metrics vs. meaningful coverage.

Implementing and tuning static analysis at scale: tool selection, custom rules, noise reduction, and developer workflow integration

Identifying OWASP Top 10 vulnerabilities during code review: injection, broken auth, XSS, IDOR, security misconfiguration, and more.

Finding authentication and authorization gaps in PRs: missing auth checks, privilege escalation paths, insecure direct object references, and broken access control patterns.

Injection vulnerabilities that AI tools frequently generate: SQL injection via string concatenation, OS command injection, LDAP injection, and template injection. Why LLMs often produce vulnerable code.

Identifying patterns that leak sensitive data in PRs: PII in logs, sensitive data in error responses, insecure data transmission, and over-exposure of sensitive fields in API responses.

Detecting hard-coded secrets, API keys, passwords, and credentials in PRs. Patterns that AI tools commonly produce when generating configuration or connection code.

Conducting security-focused code reviews: identifying injection vulnerabilities, authentication flaws, and cryptographic misuse

Identifying SOLID principle violations in actual code review contexts: SRP violations (God classes), OCP violations (massive switch statements), LSP violations, ISP violations, and DIP violations.

Identifying high coupling and low cohesion in PRs: feature envy, inappropriate intimacy, message chains, and how AI-generated code often has poor coupling characteristics.

Reviewing PRs for API contract violations: breaking changes, backward incompatible modifications, incorrect status codes, inconsistent error formats, and contract testing absence.

Reviewing new dependencies added in PRs: security vulnerabilities, license compliance, dependency bloat, and what AI tools typically add when generating code that needs libraries.

Identifying when design patterns are used incorrectly or unnecessarily in PRs. AI tools often apply patterns (Factory, Singleton, Strategy) when they are not needed, increasing complexity without benefit.

Reviewing code at the architectural level: evaluating design patterns, coupling, cohesion, and long-term maintainability

Identifying N+1 query patterns in PRs: lazy loading in loops, missing eager loading, batching opportunities. Why AI-generated ORM code frequently produces N+1 patterns.

Detecting memory leak patterns in code review: unclosed resources, event listener accumulation, circular references, and cache without eviction. Common patterns in AI-generated code.

Identifying synchronous blocking in asynchronous code during review: blocking calls in async functions, missing await, sequential awaits that should be parallel, and AI-generated code that blocks event loops.

Identifying scalability bottlenecks during code review: missing pagination, inefficient algorithms, database lock contention, and AI-generated code that works for 100 records but breaks at 10 million.

Systematic failure modes in AI-generated code: hallucinated APIs, stale security patterns (MD5, DES), over-engineered abstractions, incorrect edge case handling, and training data cutoff effects.

How reviewers fall into complacency when reviewing AI-generated code: automation bias, 'it looks right' heuristics, trusting AI accuracy, and why AI code needs MORE scrutiny in some ways than human-written code.

How to structure a review workflow for PRs that mix AI-generated and human-written code: what to check first, how to assess AI sections, and how to document the review.

Criteria for rejecting AI-generated code entirely rather than refactoring it: when the AI fundamentally misunderstood the requirement, when the approach is architecturally wrong, and when fixing the code would take longer than writing it correctly.