Configure a Prompt for Code Review So the AI Receives Context, Evaluation Criteria, and Response Format
For high-quality code review, a prompt should describe the task, technical context, expected result, and analysis rules. A generic request without details often leads to superficial comments: the AI points out style issues but misses logic errors, security risks, or performance problems.
A practical approach consists of five steps: collect project context, define the reviewer role, list review criteria, specify the response format, and add limitations. After that, the same template can be adapted for different programming languages and tasks.
1. Prepare the Data for Review
Before sending code to an AI system, determine exactly what needs to be checked. The same code fragment may require different analysis depending on its purpose.
- programming language and technology stack;
- purpose of the function or module;
- performance constraints;
- security requirements;
- expected program behavior;
- known issues or areas of concern.
For example, reviewing an HTTP request handler should include input validation, error handling, and interaction with external services. Reviewing a sorting algorithm requires analysis of complexity and correctness of the result.
Do not provide secrets, access keys, passwords, personal data, or private code fragments to public AI services without checking the usage rules of the selected tool.
2. Use a Code Review Prompt Structure
A good code analysis prompt can be divided into several blocks:
- Role: who performs the review.
- Context: what the code does and where it is used.
- Task: which issues should be identified.
- Criteria: which rules should be used to evaluate the solution.
- Format: how the results should be presented.
Example of a basic template:
Perform a technical review of the following code.
Context:
language and version:
component purpose:
constraints:
expected behavior:
Check:
logic errors;
potential security issues;
performance;
readability and maintainability;
handling of exceptional situations.
For each identified issue, specify:
location in the code;
problem description;
possible consequences;
suggested fix.
If no issues are found, specify which areas were reviewed.This format encourages the model not only to rewrite code but to perform structured analysis.
3. Add Review Criteria for a Specific Task
A general checklist does not always fit every situation. The more precise the criteria, the more useful the result will be.
Security Review
For code that works with users, networks, or databases, add separate requirements:
Pay special attention to:
- input validation;
- handling of user-provided data;
- confidential information leaks;
- incorrect access control management;
- insecure configurations.Performance Review
For resource-intensive sections, it is useful to ask for evaluation of algorithms and data operations:
Check:
- possible unnecessary computations;
- repeated resource access;
- memory usage;
- scalability as data volume increases.Architecture Review
If you need to evaluate not just a single function but an application component, specify the architectural level of analysis:
Evaluate the solution structure:
- separation of responsibilities;
- component dependencies;
- extensibility;
- maintenance complexity.4. Specify the AI Response Format
Without specifying a format, the response may be inconvenient to use. For example, instead of a long description, you can request a table or a list of fixes.
A practical review format:
Response format:
Brief summary of the code state.
List of issues by priority:
critical;
important;
recommended improvements.
Fixed example only for problematic sections.
Final list of actions before sending the code to production.When reviewing large files, it is better to split the analysis into several requests: first architecture, then security, then individual functions. This reduces the risk of missing important details due to the input size.
5. Add a Clarifying Questions Mode
If there is not enough context, it is useful to prevent the AI from making assumptions. This is especially important when working with an unfamiliar project.
Before analysis, ask clarifying questions if:
- information about the purpose of the code is missing;
- performance requirements are unknown;
- input and output data descriptions are unavailable;
- expected behavior cannot be determined.This approach reduces the number of recommendations based on incorrect assumptions.
Example of a Complete Code Review Prompt
The ready-to-use version can be adapted for most tasks:
You act as an experienced developer performing a code review.
Task:
Review the provided code and find errors, potential risks, and areas for improvement.
Project context:
Language:
Version:
Code purpose:
Constraints:
Check:
logic correctness;
error handling;
security;
performance;
readability;
compliance with language best practices.
Rules:
do not suggest changes without explaining the reason;
do not rewrite the entire code without necessity;
separate required fixes from recommendations;
indicate the importance level of each issue.
Present the response in this format:
Identified issue.
Why it is a problem.
Where it is located.
How to fix it.
Example of the corrected fragment.How to Check the Quality of the Received Review
The analysis result should be evaluated not by the number of comments but by their practical value. Check that the recommendations:
- refer to specific locations in the code;
- explain the reason for the issue;
- take the purpose of the program into account;
- do not require an unjustified complete rewrite;
- can be verified by a developer.
If the AI suggests replacing a large part of the solution, ask it first to identify the minimum required fixes and explain the risks of the current approach.
Common Mistakes When Creating Prompts
- Too general a request. The phrase "review my code" does not define analysis criteria.
- Lack of context. It is impossible to evaluate whether a solution is correct without understanding the task.
- Requesting only fixes. Automatic generation of new code can hide the original problem.
- Reviewing large amounts of code without splitting. In a long file, important details may receive less attention.
- No requirements for the output format. The response becomes harder to use in practice.
Final Prompt Configuration Checklist
- Describe the purpose of the code being reviewed.
- Specify the language, version, and technologies used.
- List the required analysis areas.
- Ask for reasons and consequences of identified issues.
- Define a convenient result format.
- Prevent unsupported assumptions when data is missing.
- Review recommendations before applying changes to the project.