Prompt: Code Review Feedback

You are a principal engineer reviewing a pull request for the developers who'll merge and maintain it.

Objective: Review the code below for correctness, security and maintainability.

Context: {{Language/framework, and what this code is supposed to do}}

Constraints:
- Separate findings into Critical, Important and Minor — do not mix severities
- For each finding, give the specific line or block, not a general comment
- Do not suggest a rewrite unless the current approach is actually wrong
- Only flag style issues if they violate the project's stated conventions

Example: a missing null check on user input is Critical; an inconsistent variable name is Minor.

Output format: Return findings as a Markdown list grouped by severity, then one sentence saying whether you'd approve, request changes, or need more context.

Before answering, verify each Critical finding would actually cause a bug or vulnerability, not just a stylistic preference.

Code:
```
{{PASTE CODE HERE}}
```

Language/framework: Python 3.12, Flask. This handler updates a logged-in user's profile from a POST form.
PASTE CODE HERE:
  @app.route("/profile", methods=["POST"])
  def update_profile():
      name = request.form["name"]
      bio = request.form["bio"]
      query = f"UPDATE users SET name='{name}', bio='{bio}' WHERE id={session['user_id']}"
      db.execute(query)
      return redirect("/profile")

Critical
- The query is built with an f-string, so a name or bio containing a single quote breaks it, and untrusted input can alter the SQL — use parameterised queries, not string interpolation.

Important
- There is no length or content check on `bio` before it is stored, so a request can submit an arbitrarily large payload.
- `session['user_id']` is used without first checking it exists, so an unauthenticated request raises a KeyError rather than redirecting to login.

Minor

- The handler never checks that the UPDATE actually affected a row before redirecting, so a failed write still looks like a success to the user.
- If `name` or `bio` is missing from the form, `request.form[...]` makes Flask abort with a generic 400 Bad Request page — validate the fields explicitly if the user should see a clearer error message.

I'd request changes — the SQL injection risk is Critical and must be fixed before this merges.

Why the basic version fails

“Review this code” tends to produce either empty praise or an unranked list of forty nitpicks with no indication of which two actually matter. Both outcomes waste the reviewer’s time.

What this prompt fixes

Forcing a severity split means the two or three things that could actually break something surface first, instead of getting buried under formatting preferences. The verification step filters out findings that sound authoritative but aren’t actually bugs. Naming the reviewer’s role as a principal engineer also discourages the vague “looks good to me” default that a plain request tends to produce.

Tips per model

• Claude is good at explaining why a Critical finding matters — useful when you need to justify a blocking review to someone else.
• ChatGPT sometimes defaults to “looks good” without real scrutiny; the severity-split constraint pushes it to actually find something or explicitly say there’s nothing.
• For a large pull request, paste only the changed files or the diff rather than the whole codebase — both models review more precisely with less to hold in context at once.