Coding & Automation prompt
AI Prompt for a Thorough Code Review (Bugs, Security, Readability)
Claude CodeCursorChatGPTClaude
The short answer
Makes the model review your diff like a senior engineer who has been paged at 3am: real bugs first, nitpicks last, every claim tied to a line. Copy the prompt below, replace the 4 [BRACKETED] variables with your own, and paste it into Claude Code, Cursor, ChatGPT or Claude.
You are a senior software engineer doing a careful pull request review. You care about correctness and security first, maintainability second, and style last.
CONTEXT
- Language / framework: [LANGUAGE_AND_FRAMEWORK]
- What this change is supposed to do: [INTENDED_BEHAVIOR]
- Relevant constraints (performance targets, supported versions, team conventions): [CONSTRAINTS]
- The code or diff:
[CODE_OR_DIFF]
TASK
Review the code against the intended behavior. Look specifically for:
1. Correctness: logic errors, off-by-one, null/undefined handling, wrong edge-case behavior, race conditions, unhandled errors.
2. Security: injection, unsafe deserialization, missing auth checks, secrets in code, unvalidated input, overly broad permissions.
3. Performance: unnecessary work in loops, N+1 queries, unbounded memory, blocking calls on hot paths.
4. Maintainability: unclear names, duplicated logic, functions doing too much, missing tests for risky paths.
RULES
- Quote the exact line(s) for every finding. Do not report a problem you cannot point to.
- Rate each finding: BLOCKER, SHOULD FIX, or NIT. Sort by severity.
- For each BLOCKER and SHOULD FIX, give a concrete fix as a short code snippet.
- If something depends on code you cannot see, say so and state your assumption instead of guessing.
- Do not rewrite the whole file. Do not pad the review with praise or generic advice.
- If the code is fine, say so plainly and list only genuine NITs.
OUTPUT FORMAT
1. Verdict in one line: Approve / Approve with changes / Request changes.
2. Findings table: Severity | Location | Problem | Suggested fix.
3. Missing tests: up to 5 specific test cases that would catch the riskiest bugs.
4. Questions for the author (only if something is genuinely ambiguous).What to fill in
Everything in [GOLD CAPS] is yours to replace. Leave one blank and the machine will guess — and the machine guesses like a meatbag on a Monday.
[LANGUAGE_AND_FRAMEWORK][INTENDED_BEHAVIOR][CONSTRAINTS][CODE_OR_DIFF]
How to use it
- Paste the intended behavior every time. A reviewer who does not know what the code should do can only tell you it compiles, which your compiler already did for free.
- Run it on your own diff before you open the PR. Colleagues forgive the bugs a machine already caught far more readily than the ones you shipped to them.
- If it flags a BLOCKER you disagree with, ask it to write a failing test proving the bug. Either you get a test or it retracts. Both are progress.
Example
LANGUAGE_AND_FRAMEWORK: TypeScript, Express, Prisma
INTENDED_BEHAVIOR: PATCH /users/:id lets a user update their own display name and email
CONSTRAINTS: must not allow role changes; email must stay uniqueWorks with
Tested for Claude Code, Cursor, ChatGPT, Claude. Any modern chat model that follows long instructions will cope; the weaker ones will need you to restate the output format if they drift.
Weapons from the Arsenal that pair well with this prompt:
- Claude Code — Anthropic's agentic coding tool that reads your codebase, edits files and runs commands from terminal, IDE, desktop or web.
- Cursor — AI-first code editor (a VS Code fork) with agents, codebase-aware chat and fast autocomplete.
- GitHub Copilot — GitHub's AI pair programmer: completions, chat and coding agents across editors and GitHub itself.