Please review this file:
[File path or code]

Review the following PR:
Changes: [Description of changes]
Files: [List of modified files]

Focus areas:
- Security
- Performance
- Code readability

Review this code from a security perspective:
- SQL injection
- XSS vulnerabilities
- Authentication/authorization issues
- Sensitive information leaks

Refactoring suggestions for this legacy code:
- Conversion to modern syntax
- Performance improvements
- Testability enhancements

## Security Issues

### [CRITICAL] SQL Injection Vulnerability
**Location**: user_controller.py:45
**Issue**: User input is directly concatenated into SQL queries
**Impact**: Potential unauthorized database access and data leakage

**Current Code**:
```python
query = f"SELECT * FROM users WHERE username = '{username}'"
cursor.execute(query)

query = "SELECT * FROM users WHERE username = ?"
cursor.execute(query, (username,))

### 2. Performance

**Check Items**:
- Algorithm time complexity
- Unnecessary loops and nesting
- Database query optimization (N+1 problem)
- Potential memory leaks
- Inefficient data structures
- Cache utilization
- Lazy loading
- Batch processing opportunities
- Asynchronous processing utilization

**Output Example**:
```markdown
## Performance Improvements

### [HIGH] N+1 Query Problem
**Location**: blog_service.ts:78-85
**Issue**: Database queries are executed within a loop

**Impact**: 101 queries are executed for 100 posts, significantly increasing response time

**Current Code**:
```typescript
for (const post of posts) {
  post.author = await db.users.findById(post.authorId);
}

const authorIds = posts.map(p => p.authorId);
const authors = await db.users.findByIds(authorIds);
const authorMap = new Map(authors.map(a => [a.id, a]));
posts.forEach(post => post.author = authorMap.get(post.authorId));

### 3. Code Quality

**Check Items**:
- Consistent naming conventions
- Single responsibility principle for functions
- DRY principle (elimination of duplication)
- Removal of magic numbers
- Appropriateness of comments
- Error handling
- Type safety
- Null/undefined checks
- Code complexity (cyclomatic complexity)

**Output Example**:
```markdown
## Code Quality

### [MEDIUM] Function is too long (Violation of Single Responsibility Principle)
**Location**: order_processor.java:120-280
**Issue**: processOrder() is 160 lines long and has multiple responsibilities

**Refactoring Suggestion**:
```java
// Current: One long function
public void processOrder(Order order) {
  // Validation logic (20 lines)
  // Inventory check (30 lines)
  // Payment processing (40 lines)
  // Notification sending (25 lines)
  // Logging (15 lines)
  // Database update (30 lines)
}

// Recommended: Split into functions
public void processOrder(Order order) {
  validateOrder(order);
  checkInventory(order);
  processPayment(order);
  sendNotifications(order);
  updateDatabase(order);
  logOrderProcessing(order);
}

### 4. Architecture and Design Patterns

**Check Items**:
- Application of SOLID principles
- Proper use of design patterns
- Layer separation (separation of concerns)
- Dependency injection
- Interface design
- Modularity
- Scalability
- Extensibility

### 5. Testing

**Check Items**:
- Existence of tests
- Test coverage
- Test quality (AAA pattern)
- Edge case coverage
- Proper use of mocks
- Test independence
- Test readability

### 6. Error Handling and Logging

**Check Items**:
- Proper exception handling
- Clarity of error messages
- Preservation of stack traces
- Resource cleanup
- Appropriateness of logging levels
- Non-logging of sensitive information

### 7. Documentation

**Check Items**:
- Appropriateness of comments
- API documentation
- Explanation of complex logic
- Management of TODO/FIXME items
- Completeness of README

## Review Output Format

### Standard Review Report

```markdown
# Code Review Results

## Summary
- **Overall Rating**: B+ (Good)
- **Critical Issues**: 0
- **High Issues**: 2
- **Medium Issues**: 5
- **Low Issues**: 8
- **Improvement Suggestions**: 12

## Important Issues

### [HIGH] Security: Missing CSRF Protection
**File**: api/routes.py:45-67
**Description**: POST endpoints lack CSRF protection
**Recommendation**: Enable Flask's CSRF protection
**Priority**: Immediate action recommended

### [HIGH] Performance: Synchronous File I/O
**File**: upload_handler.js:89
**Description**: Large files are read synchronously
**Impact**: Server blocking, potential timeouts
**Recommendation**: Change to asynchronous I/O or streaming processing

## Improvement Suggestions

### Code Duplication Reduction
Similar validation logic is duplicated across three controllers. It is recommended to create a common validator utility.

### Type Safety Improvement
TypeScript's `any` type is used in 15 places. It is recommended to create appropriate type definitions or interfaces.

## Best Practices

✅ Properly implemented aspects:
- Appropriate error handling
- Consistent naming conventions
- Good unit test coverage (85%)

## Recommended Actions

1. **Immediate Action** (Critical/High):
   - Implement CSRF protection
   - Switch to asynchronous I/O

2. **Short-Term Action** (Medium):
   - Reduce code duplication
   - Improve type safety
   - Refactor complex functions

3. **Long-Term Improvement** (Low):
   - Expand documentation
   - Improve test coverage
   - Enhance code comments

Custom review rules:
- Implement rate limiting for all API endpoints
- Database migrations must be rollbackable
- All public functions require JSDoc comments
- Error responses must follow standard format

# .github/workflows/code-review.yml
name: Automated Code Review
on: [pull_request]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Code Review
        run: |
          # Automated review by Claude
          claude-code review --pr ${{ github.event.pull_request.number }}

#!/bin/bash
# .git/hooks/pre-commit
claude-code review --staged --quick

Please review the following PR:

Title: Add user authentication feature
Modified Files:
- src/auth/login.ts (new)
- src/auth/jwt.ts (new)
- src/middleware/auth.ts (new)
- src/routes/api.ts (modified)

Changes:
- Implemented JWT-based authentication
- Added login endpoint
- Created authentication middleware

Review this bug fix:
Issue: User list loading is slow
Fix: Query optimization and caching addition

Review this refactoring:
Change: Split 500-line function into 10 small functions
Purpose: Improve maintainability and testability

Please review this PR:

File: src/payment/processor.py

Changes: Implementation of credit card payment processing

Key check items:
- Security (handling of card information)
- Error handling
- Transaction management
- PCI DSS compliance