# AI Pull Request Review: Findings With Repro Evidence

A code review should help a maintainer decide whether a change is safe to integrate. Give AI the exact base and head revision, project instructions and the relevant diff. Ask it to inspect callers and data flow, then report concrete problems with a trigger, effect and useful verification step.

## Your brief

1. Identify repository, base and head revisions and the intended behavior change. Confirm access to the actual files and keep unrelated dirty work or secrets out of the review material.

   ____________________

2. Supply relevant instructions, the diff, surrounding code and existing test results. State which checks were run by you, by CI or not at all.

   ____________________

3. Define review priorities such as authorization, data loss, compatibility and the affected user journey. Keep cosmetic preferences separate from integration-blocking defects.

   ____________________

## Prompt

Review [base..head diff] with [instructions and context]. Trace affected callers and report only actionable findings with file, trigger, impact and a verification suggestion. Separate confirmed defects, open questions and optional style notes. Do not invent test execution or approve inaccessible code. Summarize actual validation and remaining limits before any merge decision.

## Illustrative example

Illustrative change removes an ownership filter from a record lookup. The review traces the caller and asks whether another authorization check still enforces ownership. If no guard exists, it describes a concrete cross-user access scenario and a focused test. It does not label every untested line a security vulnerability or claim a test ran merely because it proposed one.

## Acceptance checks

- [ ] Are findings grounded in the actual diff and reachable code path, with a concrete trigger?
- [ ] Are severity, effect and verification clear without speculative accusations?
- [ ] Are source inspection, executed tests, CI status and production evidence distinguished?

Do not merge based solely on a confident AI approval. Review the diff and meaningful checks, preserve authorization and data-integrity constraints, and keep deployment as a separately authorized operation.

---

Brainbaby · https://brainbaby.ai/blog/ai-pull-request-review-checklist

CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/