Sign inReview today's PR

Blog

Notes on code review as a skill: how to practice it, how to read AI-generated code, and what strong reviewers catch that the rest of us walk past.

2026-10-19 · 7 min read

Coding agents leaked more than 13,000 internal screenshots to public GitHub repos while trying to get their pull requests reviewed

AI coding agents published review screenshots to public GitHub repos: 13,000+ images from 300+ organizations. They were made for a reviewer to see. What to check in an agent's pull request.

Practice code review

2026-09-23 · 7 min read

DiffDojo vs ReviewReady vs CodeReviewLab vs code-review.org: code review practice platforms compared

An honest comparison of four places to practice code review: DiffDojo, ReviewReady, CodeReviewLab and code-review.org. Format, grading, languages, price and signup, checked 2026-09-23.

2026-09-05 · 8 min read

LeetCode alternative for code review: where to practice reviewing pull requests

Comparison of tools for practicing code review: DiffDojo, LeetCode, Exercism, Code Review Stack Exchange, and CodeReviewLab. Where to practice reviewing pull requests for free.

2026-07-22 · 6 min read

A code review example: one PR, fully annotated

Not a definition of code review. An actual one: a small AI-written PR, the comments a strong reviewer leaves on it, and the verdict with reasons.

2026-07-20 · 5 min read

How to practice code review (deliberately)

Nobody teaches you to review code, and the job gives you no feedback loop. What deliberate practice looks like for reviewing, and an honest comparison of the places to get your reps.

Code review exercises

2026-09-23 · 7 min read

Integer overflow in code review: silent wraps, loud crashes, and five PRs to practice on

Integer overflow in real pull requests: where it wraps, where it crashes, and five PRs to practice on.

2026-09-08 · 7 min read

Off-by-one errors in code review: five shapes, twelve PRs, and why round test data hides all of them

Five shapes of off-by-one bug, with the bug line, the review comment, and twelve PRs to practice on.

2026-09-07 · 9 min read

LLM app code review: 15 Python exercises on the OpenAI SDK

12 planted bugs and 3 clean PRs across the patterns that break LLM apps in production: prompt injection, retry storms, leaked keys, unit mismatches, and more. All on the openai SDK 1.x, no LangChain.

2026-09-05 · 7 min read

React code review exercise: can an older search response win?

A React search component where an older response overwrites a newer one. Full walkthrough with the race condition, the fix, and the test that catches it.

2026-09-05 · 7 min read

React code review exercise: would you approve this search component?

A clean React search component that already handles AbortController correctly. Practice the skill of defending an approve verdict.

2026-09-05 · 6 min read

React code review exercise: the timer that stops at one

A time-on-page counter that silently reports one second for every user. Walk through the stale closure and the fix.

2026-09-05 · 6 min read

Code review exercise: why pagination hides the last records

Math.floor in a pagination component silently hides the last page of records. The bug, the fix, and the test that catches it.

2026-09-05 · 7 min read

Python code review exercise: an authenticated export leaks tenant data

A FastAPI CSV export authenticates the caller but never scopes the query to their org. Walkthrough with fix and test.

2026-09-05 · 7 min read

Python code review exercise: a search query becomes SQL

An AI-generated search endpoint builds SQL from user input with an f-string. The trigger, the exploit, the fix, and the test.

2026-09-05 · 6 min read

JavaScript code review exercise: the import succeeds before it finishes

A user import reports success, but the table is short a handful of rows. The root cause: forEach with an async callback.

2026-09-05 · 6 min read

AI code review exercise: a convincing Lodash method that does not exist

The PR calls _.deepMerge, a Lodash method that does not exist. How to spot hallucinated APIs, verify them, and fix the code.

2026-09-05 · 6 min read

Python code review exercise: passing tests that cannot catch a wrong rate

Every pytest case passes, but the test suite cannot catch a wrong VAT rate. Walkthrough, fix, and the mutation that proves it.

2026-09-05 · 6 min read

JavaScript code review exercise: correct output, billions of comparisons

A five-line function returns correct results and blocks production for minutes. The quadratic bug hiding inside readable array methods.

Reviewing AI-generated code

2026-09-15 · 7 min read

"I am reviewing AI code for a problem that would have taken me weeks." You do not need to be able to write it to review it.

The r/cscareerquestions post about owning code you could not have written, and the six review questions that need no authoring skill.

2026-09-14 · 6 min read

"How do you even review AI code?" Two Reddit threads, two hundred comments, and the twenty-minute triage nobody posted

Two Reddit threads on drowning in AI PRs, and the twenty-minute, bug-class-first triage neither of them posted.

2026-09-11 · 5 min read

Slopsquatting, a year on: the models hallucinate less, but five of them invent the same package names

Frontier models hallucinate fewer packages, but five of them invent the same names, and 53 were free to register. Two real 2026 incidents.

2026-09-04 · 6 min read

Your tests pass and the bug is still there, because the tests were never checking for it

Three patterns where AI-generated tests are green and the bug ships anyway: tautological assertions that move with the code, mocked-away rules that verify wiring instead of behavior, and unawaited promises that never run. Code examples and what to look for.

2026-09-01 · 6 min read

Code review checklist: 13 checks that still work when AI writes the code

Five core checks worth running on every pull request, plus the three that barely mattered five years ago: hallucinated dependencies, diffs that look like improvements, and code that solves a slightly different problem than the one asked.

2026-07-29 · 5 min read

AI now writes the tests for its own code, and that changes what green means

16.4% of test-adding commits are AI-authored, coverage is comparable, assertions doubled. The metrics look fine, which is exactly the problem: when the same model writes the code and its tests, the suite is a self-portrait.

2026-07-25 · 5 min read

Technical debt is sneaking in through AI-generated code

GitClear's analysis of 623 million code changes: duplication up 81%, refactoring down 70%, error masking up 47%. None of it fails a test, all of it passes review, and the reviewer is the only gate that can stop it.

2026-07-23 · 5 min read

Engineering leaders should check AI-generated code more than ever

78% of engineering leaders trust AI-generated code more than a year ago. 61% shipped a production incident from it in the last 90 days. Both numbers come from the same survey, and the gap between them is the story.

2026-07-22 · 5 min read

Slopsquatting: the supply chain attack your code review should catch

The model invents a package, an attacker registers it, your dependency tree does the rest. What the recent cases looked like, and why the bad line sails through review.

2026-07-20 · 6 min read

How to review AI-generated code: a guide for the human in the loop

AI bugs don't look like human bugs: they're clean, confident, and locally idiomatic. The six failure modes to check on every AI-written PR, with a diff you can test yourself on.

AI reviewers and benchmarks

2026-09-16 · 6 min read

I ran Claude Code as a reviewer on six planted-bug PRs. It caught all five bugs, and got one of them wrong.

Claude Code reviewed six planted-bug PRs. It caught all five bugs, misjudged one, and blocked the clean one. The review skills that are still yours.

Living benchmark

AI code review recall, measured on DiffDojo PRs

Monthly model results by defect class, public versus holdout scores, methodology, and a downloadable CSV.

2026-09-13 · 4 min read

GitHub let Copilot approve pull requests this month. Its recall on real bugs is 25 to 34 percent.

Copilot can now approve PRs. Two 2026 benchmarks put its recall at 25% and 34%. What the green check is worth.

2026-09-12 · 4 min read

AI code review benchmarks, 2026 update: the numbers got worse, and diff size explains why

Three new benchmarks and two papers since July. Recall 15-49%, and F1 collapses fifteen-fold once diffs pass 150 lines.

2026-07-28 · 5 min read

AI code reviewers miss about half the bugs, and nobody benchmarks the human catching the rest

8 tools against 67 real production bugs: the winner found 30, the best recall was 49%. What the benchmark says about trusting a bot's silence, and the number nobody measures: yours.

Incidents a review would have caught

2026-09-10 · 6 min read

The CrowdStrike outage was a bounds check against the wrong array, and it would pass most code reviews

21 fields defined, 20 supplied, 8.5 million machines. The CrowdStrike mechanism as a 22-line PR you can review.

2026-09-09 · 6 min read

Knight Capital lost $460 million in 45 minutes because a PR reused a retired feature flag

Dead code, a repurposed flag, 7 of 8 servers, $460M in 45 minutes. The Knight Capital mechanism as a reviewable PR.

2026-09-08 · 5 min read

Every 30GB Zune froze on the last day of 2008 because of a dozen lines with no else branch

A leap-year loop with no exit for day 366 froze two product lines. The dozen lines, and the same bug as a reviewable PR.

2026-08-30 · 6 min read

An AI wrote the bug. Another AI exploited it. A human approved it.

The Snowflake / Copilot Autofix incident, read as a review exercise: the vulnerable diff looked like a security improvement, the attribution fight is a decoy, and the reviewer is the only position left with leverage.

2026-08-17 · 4 min read

Half of Bluesky went down because one endpoint skipped one line. Would you have caught it in review?

15-20 thousand URIs per batch, one goroutine each, no limit. The postmortem, the death spiral that followed, and the review question that would have stopped it. With the same bug rebuilt as a PR you can review.

Interviews and careers

2026-07-27 · 6 min read

The coding interview is quietly turning into a code review interview

38.5% of candidates show AI-cheating signs and models solve LeetCode mediums in seconds, so the write-code round measures nothing. Google's replacement hands you a codebase and asks what's wrong with it. How to prepare.

2026-07-26 · 6 min read

Junior developers should learn code review before anyone pays them to write code

Employment for developers aged 22-25 is down 20% while every older cohort held or grew. The junior roles coming back are AI-oversight roles, and review judgment is the new entry ticket.