What Actually Happens in Our Code Review

Three Checks, No Exceptions

Every pull request that reaches production — whether a human wrote the first draft or AI scaffolded it — passes through the same three gates:

1. Correctness review. A senior engineer reads the diff line by line and checks it against the original requirement. Not a rubber stamp — an actual re-derivation of "does this do what we said it would."
2. Security pass. Auth boundaries, input validation, and data exposure are checked explicitly, using a checklist we've refined over dozens of projects, not a general "looks fine" glance.
3. Test coverage. New logic ships with tests that fail without the change. If AI drafted the tests, an engineer verifies they actually exercise the edge cases, not just the happy path.

Why This Matters More With AI in the Loop

AI-generated code has a specific failure pattern: it's often plausible — it reads fine, it compiles, it even passes a quick manual test — but it can miss an edge case a human would have caught by understanding the business context. Our review process is built assuming that, not hoping it won't happen.

What This Costs You

Slower merges, on paper. In practice, it's the difference between shipping once and shipping right, versus shipping fast and then spending a sprint firefighting a bug that made it to production.