001

The checklist I run on every block of code the AI writes.

Twenty-seven questions. The first three sections are specific to generated code — the ones ordinary review does not look for, because the code reads as well written. The other three are review proper, which you still need.

27 questions

APIs that do not exist

specific to generated code
  • Every method, option or field you do not recognise: did you check the docs, or only the autocomplete?
  • Do options passed to built-in functions actually exist? An invented option does not error — it is silently ignored.
  • Does the library have this function in *this* version? Check the installed package.json, not a 2023 article.
  • Do all the imports resolve without the editor quietly fixing them for you?

Silent edge cases

specific to generated code
  • Empty array: dividing by length, reading [0], reduce with no initial value.
  • Are null and undefined told apart from 0 and the empty string, or did they all fall into one if?
  • Do sorts have a comparator? sort() with no argument sorts as text: 9900 before 24900.
  • Money in integer cents, never floats. And rounding decided, not inherited.
  • Dates: timezone set explicitly, and day, month and DST boundaries tested.

Error handling that only looks like it

specific to generated code
  • Does every catch do something besides log? Logging is not handling.
  • After a catch, does execution carry on into code that assumed success?
  • fetch: is res.ok checked? A 500 returns a valid response — fetch does not reject.
  • Does the message the user sees tell them what to do next, or only that something broke?
  • Is the error logged with enough context to reproduce it without guessing?

Correctness

  • Did you write a test that fails *before* the fix and passes after?
  • Did you read the whole file, or only the diff? What the AI deleted does not appear in the diff it shows you.
  • Can you explain every line out loud? The one you cannot explain is the one that breaks you.
  • Do the names tell the truth about what the function does now, or about what it used to do?

Security

  • User input validated on the server, not only on the client.
  • Parameterised queries. No SQL built by string concatenation.
  • Secrets out of the code and out of the client bundle — anything NEXT_PUBLIC_ is public.
  • Authorisation checked per request: who owns this record, not merely who has a session.
  • New dependencies: who maintains them, how many downloads, and when was the last release?

Performance

  • Are there database queries inside loops? That is the N+1, and it always arrives in production.
  • Could each await inside a for be a Promise.all?
  • What runs on every request that could be computed once and cached?
  • Does the response return fields nobody uses? Payload is latency.

This is the M12 review — Verifying Code You Did Not Write — on one page. Run it on the next thing you generate.