ChatGPT Prompts for Code Reviews

Stop Asking ChatGPT "Is this code good?"

If you paste a 500-line React component into ChatGPT and ask, "Is this good?", you will receive a generic, unhelpful response. It will likely tell you that your code is "well-structured" and perhaps offer a minor syntax tweak. To get true value out of an LLM for code reviews, you must assign it a strict persona, constrain its focus, and demand specific output formats. You need to turn the AI into a brutal, unforgiving Senior Staff Engineer.

The Persona Prompt Architecture

When prompting for a code review, always use this 3-part framework: 1. The Persona, 2. The Constraints, 3. The Required Output Format.

The "Security & Performance" Prompt

"Act as a Senior Staff Security Engineer. Review the following Node.js/Express code. I do not care about formatting, naming conventions, or minor stylistic preferences. Your sole job is to identify critical security vulnerabilities and severe performance bottlenecks.

Focus specifically on:
- SQL Injection, XSS, and CSRF vulnerabilities.
- Missing rate limiting or authentication bypass vectors.
- O(N^2) loops or N+1 database query problems.

Output Format: For every issue found, provide a markdown table containing [Severity 1-10], [Vulnerability Name], [Explanation], and [Refactored Code Block]."

The "Edge Case Annihilator" Prompt

Developers are notoriously bad at testing the "unhappy path." AI is brilliant at it.

"Act as a QA Automation Expert. Review this data validation function. Do not rewrite the function. Instead, provide me with a bulleted list of 10 bizarre, malicious, or highly unlikely edge cases that would cause this specific function to throw an unhandled exception or return corrupt data. Think about massive file sizes, invalid unicode characters, negative time arrays, and race conditions."

The Context Window Warning

If your code relies on 5 external utility files, the AI cannot see them. If you ask it to review processOrder.ts, you must also paste the contents of databaseUtils.ts and emailService.ts into the prompt. If you don't, the AI will "hallucinate" what those functions do, resulting in a completely useless and inaccurate code review.