Claude Code for Code Review: Catching Bugs Before They Hit Production

Why AI Code Review Matters

Code review is one of the highest-value activities in software development. Studies consistently show that code review catches 60-90% of defects before they reach production. But human reviewers face real constraints: they are tired, rushed, and have limited context about unfamiliar parts of the codebase.

Claude Code is not a replacement for human code review — it is a complement. By catching mechanical issues (bugs, security vulnerabilities, performance problems, missing edge cases), it frees human reviewers to focus on architecture, design, and business logic decisions.

Quick Review with /review

The fastest way to get a code review is the built-in /review command:

/review

Claude Code examines your uncommitted changes (equivalent to git diff) and provides structured feedback. The review covers:

• Correctness — Logic errors, edge cases, off-by-one errors
• Security — Input validation, injection vulnerabilities, authentication gaps
• Performance — Inefficient queries, unnecessary allocations, missing caching
• Style — Convention violations, naming issues, dead code
• Testing — Missing test coverage, weak assertions

Targeted Review Prompts

For more focused reviews, use natural language prompts:

Security-Focused Review

Review the changes in app/api/ for security vulnerabilities. Check for:
1. SQL injection
2. XSS in rendered templates
3. Missing authentication checks
4. Sensitive data exposure in responses
5. CSRF protection gaps

Performance Review

Review the database queries in the recent changes. Look for:
1. N+1 query patterns
2. Missing indexes on queried columns
3. Unbounded queries without LIMIT
4. Unnecessary eager loading
5. Queries inside loops

API Contract Review

Review the new API endpoints for contract consistency:
1. Do response shapes match our standard { success, data, error } format?
2. Are HTTP status codes correct (201 for create, 204 for delete)?
3. Are error responses consistent?
4. Is input validation complete?

Real Bugs Claude Code Catches

Here are categories of bugs that Claude Code consistently catches in code reviews.

1. Race Conditions

# Bug: check-then-act race condition
async def transfer_funds(from_account, to_account, amount):
    balance = await get_balance(from_account)
    if balance >= amount:  # Check
        await deduct(from_account, amount)  # Act — another request could deduct between check and act
        await credit(to_account, amount)

Claude Code flags this pattern and suggests using database-level locking:

# Fix: Use SELECT FOR UPDATE to prevent concurrent modifications
async def transfer_funds(from_account, to_account, amount):
    async with db.begin():
        balance = await db.execute(
            select(Account.balance)
            .where(Account.id == from_account)
            .with_for_update()
        )
        if balance.scalar() >= amount:
            await db.execute(
                update(Account).where(Account.id == from_account)
                .values(balance=Account.balance - amount)
            )
            await db.execute(
                update(Account).where(Account.id == to_account)
                .values(balance=Account.balance + amount)
            )

2. Missing Error Handling

// Bug: Unhandled promise rejection
app.post("/api/orders", async (req, res) => {
  const order = await orderService.create(req.body);
  const payment = await paymentService.charge(order.total); // If this fails...
  await orderService.confirm(order.id, payment.id);         // ...this never runs, order is in limbo
  res.json({ success: true, data: order });
});

Claude Code identifies the missing error handling and suggests a compensating transaction:

// Fix: Handle payment failure, compensate the order
app.post("/api/orders", async (req, res, next) => {
  const order = await orderService.create(req.body);
  try {
    const payment = await paymentService.charge(order.total);
    await orderService.confirm(order.id, payment.id);
    res.status(201).json({ success: true, data: order });
  } catch (error) {
    await orderService.cancel(order.id, "Payment failed");
    next(error);
  }
});

3. SQL Injection Through String Interpolation

# Bug: SQL injection vulnerability
@app.get("/api/users/search")
async def search_users(query: str, db: AsyncSession = Depends(get_db)):
    result = await db.execute(
        text(f"SELECT * FROM users WHERE name LIKE '%{query}%'")  # Injection!
    )
    return result.fetchall()

Claude Code catches this immediately and suggests parameterized queries:

# Fix: Parameterized query
@app.get("/api/users/search")
async def search_users(query: str, db: AsyncSession = Depends(get_db)):
    result = await db.execute(
        text("SELECT id, name, email FROM users WHERE name LIKE :pattern"),
        {"pattern": f"%{query}%"}
    )
    return result.fetchall()

4. Off-by-One in Pagination

// Bug: Returns 11 items when limit is 10 (off-by-one)
async function getUsers(page: number, limit: number) {
  return prisma.user.findMany({
    skip: (page - 1) * limit,
    take: limit + 1, // Developer intended "hasMore" check but forgot to slice
  });
}

5. Timezone-Naive Date Comparisons

# Bug: Comparing timezone-aware DB timestamps with naive datetime
from datetime import datetime

async def get_recent_orders(db):
    cutoff = datetime.now()  # Naive — no timezone!
    return await db.execute(
        select(Order).where(Order.created_at > cutoff)  # DB stores UTC
    )

Claude Code catches the timezone mismatch:

# Fix: Use timezone-aware datetime
from datetime import datetime, timezone

async def get_recent_orders(db):
    cutoff = datetime.now(timezone.utc)
    return await db.execute(
        select(Order).where(Order.created_at > cutoff)
    )

Review Workflow for Pull Requests

Interactive PR Review

Review the changes in this PR. The git diff is:
[paste git diff or use: git diff main...feature-branch]

Focus on:
1. Are there any bugs?
2. Are there security concerns?
3. Will this cause performance issues at scale?
4. Are there missing edge cases?

Headless PR Review in CI

#!/bin/bash
# .github/workflows/ai-review.yml (simplified)
DIFF=$(git diff origin/main...HEAD)
REVIEW=$(echo "$DIFF" | claude -p "Review this diff. Report only: bugs, security issues, and performance problems. Format as a markdown checklist." 2>/dev/null)

# Post review as PR comment
gh pr comment "$PR_NUMBER" --body "$REVIEW"

Limitations of AI Code Review

Claude Code's reviews are powerful but have known limitations:

1. Business logic validation — Claude Code does not know your business rules unless documented in CLAUDE.md. It cannot tell if a 10% discount should actually be 15%.

2. Complex state machines — Multi-step workflows with many state transitions can exceed the model's ability to reason about all possible paths.

3. Performance at scale — Claude Code can identify N+1 queries and missing indexes, but it cannot predict performance at 10,000 requests per second without load testing data.

4. Style subjectivity — Different teams have different style preferences. Claude Code follows common conventions unless CLAUDE.md specifies otherwise.

5. False positives — Occasionally Claude Code flags code as problematic when it is actually correct. Always apply your own judgment to review feedback.

Best Practices for AI-Assisted Code Review

1. Use AI review as the first pass — Let Claude Code catch mechanical issues before human reviewers look at the code.

2. Focus human review on design — With mechanical issues handled, human reviewers can focus on architecture, maintainability, and business logic.

3. Document conventions in CLAUDE.md — The more Claude Code knows about your standards, the more relevant its review feedback.

4. Combine /review with targeted prompts — Use /review for a broad sweep, then follow up with specific questions about areas of concern.

5. Automate in CI — Use headless mode to run Claude Code reviews on every PR automatically.

Conclusion

Claude Code catches real bugs — race conditions, injection vulnerabilities, missing error handling, off-by-one errors, timezone issues — that human reviewers frequently miss because they are tedious to check manually. By integrating Claude Code reviews into your workflow (both interactive and CI-automated), you add a tireless, consistent reviewer to your team that covers the mechanical aspects of code quality, freeing your human reviewers to focus on the decisions that require human judgment.