Code review examples: 20 annotated PRs
As of October 2026, DiffDojo publishes 20 worked code review examples: pull requests retired from its practice pool, each with the full diff and the canonical review. The live library keeps its answers hidden until you review; these are the ones you can read first.
Python
- datetime.now() is naive: comparing it to an aware datetime raises, and it's local time anyway in Python
- Deleting from a dict while iterating it raises RuntimeError in Python
- requests.get with no timeout can hang the handler forever in Python
- 'Newest first' but sorted ascending: the order is reversed in Python
- yaml.Loader on untrusted input can construct arbitrary Python objects in Python
React
- Secret in a client component: the billable key is either undefined or public in React
- memo defeated: a fresh callback per render re-renders every row anyway in React
- Stored XSS: one malicious bio runs script in every visitor's browser in React
- Wrong sort key: comments ordered by author name, not recency in React
- Hallucinated useMount hook: the component fails at build or crashes on first render in React
Node
- IDOR: any logged-in user can read every other user's order in Node
- Missing error path: one bad row aborts the whole import in Node
- Wrong API flavor: awaiting callback-style fs.stat crashes every call in Node
- Requirement mismatch: the promised 'jump to last page' control can't be built in Node
- Hallucinated API: axios has no retries option, so nothing ever retries in Node
Angular
- body-only edits don't reliably autosave: body() is read outside effect's tracking in Angular
- Inputs aren't set in the constructor: url is computed from empty values in Angular
- ngOnInIt is not a hook: the load method is dead code with a plausible name in Angular
- colorIndex is bounded against the series count, not the palette length in Angular
- bypassSecurityTrustHtml on user content: the sanitizer was the defense in Angular