Code Review

# Task
Review the code below as a senior engineer. Base ALL findings on the provided code — never invent issues to fill space.

# Source
{code_or_diff}

# Context
- Goal: {goal}
- Constraints: {constraints}

# Review dimensions
Evaluate across these areas in order of priority:
1. **Correctness**: Logic errors, off-by-one, null/undefined risks, race conditions, wrong return types.
2. **Security**: Injection risks (SQL, XSS, command), auth/authz gaps, secrets exposure, unsafe deserialization.
3. **Reliability**: Unhandled errors, missing edge cases, resource leaks, failure modes without recovery.
4. **Maintainability**: Naming clarity, function length, coupling, duplication, missing or misleading comments.
5. **Performance**: Only flag if there's a concrete risk (N+1 queries, O(n²) on large input, unnecessary allocations).

# Finding format
For each issue:
- **Severity**: Blocker (must fix before merge) | Major (should fix) | Minor (suggestion) | Nitpick (style only)
- **Location**: File and line reference or quote the code
- **Problem**: What's wrong (1-2 sentences)
- **Risk**: What could go wrong if not fixed
- **Fix**: Concrete code suggestion or approach (not generic advice)

# Rules
- Max 10 findings. Prioritize blockers and majors.
- If reviewing a diff: focus on changed lines but flag if changes break existing code.
- Separate confirmed issues from suspicions. Mark uncertain items [VERIFY].
- Do NOT flag style preferences unless they affect readability.
- Always end with what's done well (1-3 specific positives).

# Output
1. **Summary verdict**: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION (with 1-sentence rationale)
2. **Findings** (ranked by severity)
3. **Security checklist**: Pass/Fail for: input validation, auth checks, secrets handling, error exposure
4. **Positives** (1-3 things worth keeping)

<source>{code_or_diff}</source>
<context>
  <goal>{goal}</goal>
  <constraints>{constraints}</constraints>
</context>
<task>Review the code above as a senior engineer. Base ALL findings on the provided code.</task>
<instructions>
  Dimensions (in priority order): correctness, security, reliability, maintainability, performance (only concrete risks).

  Per finding: Severity (Blocker/Major/Minor/Nitpick), location, problem, risk, concrete fix.

  Max 10 findings. Focus on changed lines in diffs. Mark uncertain items [VERIFY]. Don't flag style preferences. End with positives.
</instructions>
<output>
  Return: summary verdict (APPROVE/REQUEST CHANGES/NEEDS DISCUSSION), findings ranked by severity, security checklist (input validation, auth, secrets, error exposure), positives (1-3).
</output>

Code or diff:
{code_or_diff}

Goal: {goal}
Constraints: {constraints}

Review as a senior engineer. Dimensions: correctness, security, reliability, maintainability, performance (concrete risks only).

Per finding: Severity (Blocker/Major/Minor/Nitpick), location, problem, risk, concrete fix.

Max 10 findings. Mark uncertain items [VERIFY]. End with positives.

Based on the entire content above, return:
1. Verdict: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION
2. Findings ranked by severity
3. Security checklist: input validation, auth, secrets, error exposure
4. Positives (1-3)