DiffDojo Blog — code review as a skill

2026-09-07 · 9 min read

LLM app code review: 15 Python exercises on the OpenAI SDK

12 planted bugs and 3 clean PRs across the patterns that break LLM apps in production: prompt injection, retry storms, leaked keys, unit mismatches, and more. All on the openai SDK 1.x, no LangChain.

2026-09-05 · 8 min read

LeetCode for code review: where to practice reviewing pull requests

Comparison of tools for practicing code review: DiffDojo, LeetCode, Exercism, Code Review Stack Exchange, and CodeReviewLab. Where to practice reviewing pull requests for free.

2026-09-05 · 7 min read

React code review exercise: can an older search response win?

A React search component where an older response overwrites a newer one. Full walkthrough with the race condition, the fix, and the test that catches it.

2026-09-05 · 7 min read

React code review exercise: would you approve this search component?

A clean React search component that already handles AbortController correctly. Practice the skill of defending an approve verdict.

2026-09-05 · 6 min read

React code review exercise: the timer that stops at one

A time-on-page counter that silently reports one second for every user. Walk through the stale closure and the fix.

2026-09-05 · 6 min read

Code review exercise: why pagination hides the last records

Math.floor in a pagination component silently hides the last page of records. The bug, the fix, and the test that catches it.

2026-09-05 · 7 min read

Python code review exercise: an authenticated export leaks tenant data

A FastAPI CSV export authenticates the caller but never scopes the query to their org. Walkthrough with fix and test.

2026-09-05 · 7 min read

Python code review exercise: a search query becomes SQL

An AI-generated search endpoint builds SQL from user input with an f-string. The trigger, the exploit, the fix, and the test.

2026-09-05 · 6 min read

JavaScript code review exercise: the import succeeds before it finishes

A user import reports success, but the table is short a handful of rows. The root cause: forEach with an async callback.

2026-09-05 · 6 min read

AI code review exercise: a convincing Lodash method that does not exist

The PR calls _.deepMerge, a Lodash method that does not exist. How to spot hallucinated APIs, verify them, and fix the code.

2026-09-05 · 6 min read

Python code review exercise: passing tests that cannot catch a wrong rate

Every pytest case passes, but the test suite cannot catch a wrong VAT rate. Walkthrough, fix, and the mutation that proves it.

2026-09-05 · 6 min read

JavaScript code review exercise: correct output, billions of comparisons

A five-line function returns correct results and blocks production for minutes. The quadratic bug hiding inside readable array methods.

2026-09-04 · 6 min read

Your tests pass and the bug is still there, because the tests were never checking for it

Three patterns where AI-generated tests are green and the bug ships anyway: tautological assertions that move with the code, mocked-away rules that verify wiring instead of behavior, and unawaited promises that never run. Code examples and what to look for.

2026-09-01 · 6 min read

A code review checklist that still works when AI writes the code

Five core checks worth running on every pull request, plus the three that barely mattered five years ago: hallucinated dependencies, diffs that look like improvements, and code that solves a slightly different problem than the one asked.

2026-08-30 · 6 min read

An AI wrote the bug. Another AI exploited it. A human approved it.

The Snowflake / Copilot Autofix incident, read as a review exercise: the vulnerable diff looked like a security improvement, the attribution fight is a decoy, and the reviewer is the only position left with leverage.

2026-08-17 · 4 min read

Half of Bluesky went down because one endpoint skipped one line. Would you have caught it in review?

15-20 thousand URIs per batch, one goroutine each, no limit. The postmortem, the death spiral that followed, and the review question that would have stopped it. With the same bug rebuilt as a PR you can review.

2026-07-29 · 5 min read

AI now writes the tests for its own code, and that changes what green means

16.4% of test-adding commits are AI-authored, coverage is comparable, assertions doubled. The metrics look fine, which is exactly the problem: when the same model writes the code and its tests, the suite is a self-portrait.

2026-07-28 · 5 min read

AI code reviewers miss about half the bugs, and nobody benchmarks the human catching the rest

8 tools against 67 real production bugs: the winner found 30, the best recall was 49%. What the benchmark says about trusting a bot's silence, and the number nobody measures — yours.

2026-07-27 · 6 min read

The coding interview is quietly turning into a code review interview

38.5% of candidates show AI-cheating signs and models solve LeetCode mediums in seconds, so the write-code round measures nothing. Google's replacement hands you a codebase and asks what's wrong with it. How to prepare.

2026-07-26 · 6 min read

Junior developers should learn code review before anyone pays them to write code

Employment for developers aged 22-25 is down 20% while every older cohort held or grew. The junior roles coming back are AI-oversight roles, and review judgment is the new entry ticket.

2026-07-25 · 5 min read

Technical debt is sneaking in through AI-generated code

GitClear's analysis of 623 million code changes: duplication up 81%, refactoring down 70%, error masking up 47%. None of it fails a test, all of it passes review, and the reviewer is the only gate that can stop it.

2026-07-23 · 5 min read

Engineering leaders should check AI-generated code more than ever

78% of engineering leaders trust AI-generated code more than a year ago. 61% shipped a production incident from it in the last 90 days. Both numbers come from the same survey, and the gap between them is the story.

2026-07-22 · 6 min read

A code review example: one PR, fully annotated

Not a definition of code review. An actual one: a small AI-written PR, the comments a strong reviewer leaves on it, and the verdict with reasons.

2026-07-22 · 5 min read

Slopsquatting: the supply chain attack your code review should catch

The model invents a package, an attacker registers it, your dependency tree does the rest. What the recent cases looked like, and why the bad line sails through review.

2026-07-20 · 6 min read

How to review AI-generated code: a guide for the human in the loop

AI bugs don't look like human bugs: they're clean, confident, and locally idiomatic. The six failure modes to check on every AI-written PR, with a diff you can test yourself on.

2026-07-20 · 5 min read

How to practice code review (deliberately)

Nobody teaches you to review code, and the job gives you no feedback loop. What deliberate practice looks like for reviewing, and an honest comparison of the places to get your reps.