# Detailed Review Categories & Metrics

## Review Categories

### Security (Critical Priority)
**Must check in every review:**
- No hardcoded credentials (search: `password.*=.*['"]`, `api[_-]?key.*=`)
- Input validation on all user data
- Parameterized queries (no string concatenation for SQL)
- Authorization checks on every endpoint
- No `eval()`, `exec()`, dangerous functions

See [references/security-checklist.md](../references/security-checklist.md) for OWASP Top 10 patterns.
See [references/owasp-api-top10.md](../references/owasp-api-top10.md) for OWASP API Security Top 10.

### Logic (Critical Priority)
**Verify correctness:**
- Business logic matches requirements
- Edge cases handled (null, empty, boundary values)
- Error handling present and appropriate
- Race conditions in async code
- Resource cleanup (connections, file handles)

### Clean Code (High Priority)
**Check for code smells:**
- Large functions (>50 lines) - violate Single Responsibility
- Deep nesting (>3 levels) - extract to functions
- Long parameter lists (>3 params) - use objects
- Duplicated code - extract to shared functions
- Magic numbers/strings - use named constants

See [references/clean-code-principles.md](../references/clean-code-principles.md) for SOLID principles.

### Maintainability (Medium Priority)
**Assess long-term health:**
- Cognitive complexity <15 per function
- Clear naming that reveals intent
- Appropriate abstractions (not over-engineered)
- Test coverage for critical paths

## Code Quality Metrics

### Cognitive Complexity
- Target: <15 per function, <50 per module
- Each nesting level adds complexity
- Prefer early returns over deep nesting

### Function Size
- Target: <50 lines, ideally <20
- Should fit on one screen
- One function = one responsibility

### Cyclomatic Complexity
- Target: <10 per function
- Count: 1 + (if + while + for + case + catch + && + ||)
- High complexity = hard to test

See [references/code-quality-metrics.md](../references/code-quality-metrics.md) for detailed calculations.

## Anti-Patterns to Flag

### Nitpicking
**Problem**: Excessive minor comments bury critical issues
**Impact**: Developers become defensive, stop reading feedback
**Solution**: Automate style with linters; focus humans on logic/security

### Vague Criticism
**Problem**: "This is wrong" without explanation
**Impact**: Developer doesn't know how to fix; creates friction
**Solution**: Always include What + Why + How

### Blocking on Preferences
**Problem**: Blocking merge for subjective style preferences
**Impact**: Delays delivery; damages team trust
**Solution**: Reserve blocking for security/correctness only

### Reviewing Unchanged Code
**Problem**: Commenting on code outside the PR diff
**Impact**: Scope creep; unfair to author
**Solution**: Focus only on changed lines; file separate issues for existing problems
