2.5Code Review from a QA Perspective

Code review is one of the most effective shift-left activities QA can participate in. You bring a different perspective than the developer reviewer.

What QA Looks for in Code Reviews

Focus Area	What to Check	Example Comment
Input validation	Are inputs validated before processing?	"This endpoint accepts user input but doesn't validate the quantity field. Negative values would cause issues downstream."
Error handling	Are errors caught, logged, and handled gracefully?	"If fetchUser() throws, the catch block logs but doesn't return an error response to the client."
Edge cases	Are boundary conditions handled?	"What happens if items is an empty array here? The .reduce() call would throw."
Test coverage	Are the new tests sufficient?	"The tests cover the happy path. Should we add a test for the case where the API returns a 429?"
Logging and observability	Can we troubleshoot issues in production?	"This function handles payment processing but has no logging. If something goes wrong, we won't have a trail."
Security	Are there obvious security issues?	"This query interpolates user input directly. Should we use parameterized queries?"

How to Comment Effectively

• Be specific. Point to the exact line and explain the concern.
• Suggest, do not demand. "Consider adding validation for..." rather than "You must add validation."
• Explain why. "This could cause a NullPointerException in production when the user has no address on file" is more persuasive than "Add a null check."
• Distinguish severity. Use prefixes like [nit] for minor style issues, [question] for things you are unsure about, and [bug] for things that will cause problems.

[question] Line 42: If `user.subscription` is null (free-tier users),
this will throw. Should we default to the free plan here?

[nit] Line 67: This variable name `d` could be more descriptive --
maybe `discountPercentage`?

[bug] Line 89: The SQL query concatenates user input directly.
This is vulnerable to SQL injection. Should use parameterized queries.