Confirm that the patch solves the original problem

Write down reproduction steps and expected behavior before reading the complete diff and added files. Connect each change to a requirement or confirmed necessary repair. Isolate unexplained refactoring, dependency upgrades, and broad formatting changes so the review remains manageable. Numerous added tests may still mirror implementation without detecting the reported problem.

Trace inputs, permissions, failures, and side effects through the call chain. Look for defaults that hide invalid states, relaxed authorization, and swallowed errors. Public failures must follow existing sanitization paths; internal configuration and source details must not accidentally become customer-visible response fields.

Choose checks capable of disproving the implementation

Run a check that reproduces the original problem, then add counterexamples matching the risk: empty input, denied access, cancellation, repeated events, or partial failure. Test visible behavior rather than merely asserting that an internal function ran. Use controlled substitutes for external side effects rather than performing real payments or production writes during review.

Check that dependency changes include lockfiles, configuration examples contain placeholders, and new logs exclude sensitive input. Frontend changes may require type checking, a production build, and relevant interface inspection. Backend checks should exercise affected logic; a successful build cannot substitute for every behavioral requirement.

State conclusions with their limits

For each finding, describe the trigger, impact, and smallest useful correction. Do not presume assistant-written code is wrong, and do not lower the evidence standard because its explanation is persuasive. After correction, rerun relevant checks and confirm that files from concurrent work were not included.

Before committing, inspect secrets, the final diff, and workspace state. Report checks actually run, checks blocked by the environment, and remaining risks. Passing tests support the covered cases, not universal safety. Preserve a reversible commit and respect the separate authorization required for deployment or production changes.

Sources & further reading

An owned publication maintained by NexoToken. Product references reflect the publisher’s commercial interest and are not independent certification.