Goal
Decide whether an AI-generated code change is understandable, necessary, tested, secure enough for its context, and consistent with the repository before it is merged.
The finished result should be a reviewed diff with clear acceptance criteria and validation evidence. A tool summary, successful generation, or passing single test is not enough.
Start With Acceptance Criteria
Write down:
- the behavior that should change
- the behavior that must remain unchanged
- the files or modules expected to change
- the tests and manual checks that should pass
- the inputs, errors, and edge cases that matter
- security, performance, compatibility, and accessibility requirements
If the task cannot be explained clearly, narrow it before reviewing the code.
Review The Diff
Confirm the scope. Look for unrelated refactors, deleted checks, broad formatting changes, generated files, or configuration edits outside the task.
Read the implementation. Trace inputs, state changes, outputs, errors, cleanup, and public interfaces. Do not rely only on comments or the AI-generated explanation.
Check edge cases. Review empty input, malformed data, timeouts, retries, concurrency, partial failures, permissions, and unexpected user behavior where relevant.
Inspect dependencies and commands. Verify package names, versions, licenses, install scripts, network calls, migrations, and shell commands before running them.
Review tests. Check that tests exercise the requested behavior and meaningful failure cases rather than only reproducing the implementation.
Run repository checks. Use the project’s tests, linting, type checks, builds, security tools, and focused manual verification.
Explain the change yourself. If the reviewer cannot explain why the change works and how it can fail, it is not ready to merge.
Check Security And Secrets
Look for exposed credentials, unsafe logging, weak authorization, unvalidated input, injection paths, insecure defaults, overly broad permissions, and unexpected data transfer.
Do not paste secrets, customer data, private keys, restricted code, or private repository content into an unapproved service. Security-sensitive changes need additional review from someone qualified for the system and risk.
Check Licenses And Provenance
Review new dependencies, copied snippets, attribution needs, matching public code, generated assets, and applicable workplace or client policy. AI output does not guarantee originality, permission, or license compatibility.
Use the same diligence you would apply to unfamiliar third-party code.
Record Validation Evidence
Keep the evidence close to the change:
- acceptance criteria checked
- tests and commands run
- manual behavior reviewed
- dependency or license decisions
- security review completed where needed
- known limitations or follow-up work
Do not merge solely because the diff looks plausible or the tool reports that the task is complete.
Tools To Consider
Explore reviewed pages for Cursor, GitHub Copilot, and Windsurf, or browse the Coding Tools category. These are starting points, not rankings or guarantees of code quality.
Use the AI Tool Decision Path to compare candidates with testing and control visible. Check official pages for current access, plans, limits, repository controls, policies, and availability.
Next Steps
Choose one small AI-assisted change and review it with the same checklist used for an unfamiliar contributor. Save suitable tools to My Shortlist only after the complete review workflow has been tested.