Spot the mistakes
Guess first, no penalty. You asked an AI agent: "Add up to 3 retries to fetch_user. No new dependencies." It says "Done, tests pass." Tap the three lines of its diff a reviewer should stop on.
The diff, line by line
0 of 3 found
A diff is the list of lines a change adds and removes. An agent's summary says what it meant to do. The diff shows what it did. "Tests pass" only proves what the tests check.
Read the diff before you run or merge anything, with five checks:
- Scope. Did it change only what you asked? Watch for extra files and new dependencies (outside packages your code now needs).
- Errors. Are failures handled, or swallowed so nobody hears about them?
- Edge cases. What happens with empty input, a timeout or a missing field?
- Your codebase. Does it use your naming and helpers, or invent new ones?
- Security. Secrets in the code, SQL built from strings, a skipped permission check?
A worked example
The review comment for the diff above:
Three changes before this can merge:
1. Scope: remove "import tenacity". We agreed no new dependencies.
2. Security: read API_KEY from the environment. Rotate the key that's
in this diff, since it's now in the branch history.
3. Errors: catch requests.RequestException only, and raise after the
third failure so callers know the fetch failed.
Fine as is: the retry loop and the 5-second timeout.Fill the gaps
Fill the gaps.
Review note
Before I merge, I read the . I check it changed only , that errors are , and that no are in the code.
Try it
Your steps, about 2 minutes
- 1.Read the diff of the last change an AI made for you with the five checks, one line per check. Add the five checks to your kit.2 min