Code Review untuk AI-Generated Code: Checklist dan Best Practices
Code review untuk AI-generated code bukan same dengan traditional code review. Fokus yang berubah, red flag yang berbeda, depth yang harus lebih dalam di beberapa area.
Mengapa Traditional Code Review Tidak Cukup?
Traditional code review fokus pada: Readability, Adherence to style guide, Business logic correctness, Performance optimization.
Tapi AI-generated code punya additional risks: Hallucination — code yang look convincing tapi subtle bug, Implicit assumption — code assume context yang not documented, Edge case miss — happy path covered, edge case not.
AI Code Review Checklist
Phase 1: Pre-Review (Before Opening PR)
Understand the Prompt
First question: was the prompt specific enough? Request the original prompt in PR description.
Ask: Did AI have enough context?
If code touch database, does AI know schema? If code handle payment, does AI know requirement? If no, suspect blind spot.
Phase 2: Surface-Level Review
Style & Readability
- Follow project convention?
- Variable naming make sense?
- Function length reasonable?
- Comments clear dan not over-commented?
Dependency Check
Is this library necessary? AI might suggest unnecessary external dependencies.
Type Safety (if TypeScript)
Any any type? Loose typing? Type tidak reflect actual data shape?
Phase 3: Logic Review
Business Logic Correctness
Does code match the requirement? Trace through manually dengan sample input.
Edge Cases
Checklist: Empty input, Null/undefined, Negative numbers / out of range, Concurrent access, Large input, Type mismatch
Error Handling
Does code handle error gracefully? Or silent fail?
Phase 4: Security Review
Critical areas:
- SQL Queries — any string concatenation? Use parameterized query always
- Input Validation — any unsanitized user input?
- Authorization — check yang user bisa access only their own data
- Secrets — hardcoded API keys? Env variable access correct?
- CORS/Headers — correct security headers set?
- Data Exposure — sensitive data leak di API response?
Phase 5: Performance Review
Algorithm Efficiency
Red flag dari AI: unnecessary sorting, nested loop yang bisa avoid, database query in loop.
Memory Usage
Any large object dibuat unnecessary? Reference leak possible?
Phase 6: Testing Review
Test Coverage
Critical path covered? Edge case tested?
Test Quality
Test actually test something atau false positive?
Review Workflow
Step-by-step:
- Read PR description + original prompt
- Check if prompt was specific
- Run code locally, test manually
- Do style review (5 min)
- Do logic review (15 min) — trace through manually
- Do security review (10 min) — paranoid mindset
- Do perf review (5 min) — any obvious inefficiency?
- Check test coverage (5 min)
- Ask: "Am I confident deploying this to production?" If no, ask more questions
Total: ~45 min untuk medium PR.
Red Flags yang Auto-Block
Jika ada ini, request changes: Any security issue, Test coverage less than 70%, Obvious algorithmic inefficiency, Unclear or missing error handling, Hardcoded value yang should be config.
Kesimpulan
Code review untuk AI bukan lebih buruk dari traditional, just different. Total review time might be same atau lebih, tergantung complexity dan how well AI understand requirement.
Rule of thumb: Jika kamu tidak 100% understand code kamu review, jangan approve.
