Free Top Software List

Yes. A good prompt should push the model beyond superficial style comments and toward finding subtle correctness, design, and maintainability issues.

Here's a prompt you can use:

:::writing{variant="document" id="54821"} Review this pull request as if you are the most experienced engineer on the team.

Do not assume the code is correct just because the tests pass or the implementation looks clean. Your job is to find issues that a human reviewer might miss.

Focus on:

• Correctness: edge cases, race conditions, null/empty handling, error paths, off-by-one errors, data consistency.
• Logic: places where the implementation doesn't fully match the intended behavior or likely requirements.
• API and design: unnecessary complexity, poor abstractions, leaky interfaces, hidden coupling, maintainability.
• Performance: inefficient algorithms, unnecessary allocations, N+1 queries, blocking operations, scalability concerns.
• Security: validation, authorization, injection risks, secrets, unsafe assumptions.
• Reliability: retries, idempotency, concurrency, timeouts, resource cleanup.
• Readability: confusing naming, misleading comments, duplicated logic, opportunities to simplify.
• Testing: missing test cases, brittle tests, scenarios that should be covered.

For every issue you find:

1. Explain why it is a problem.
2. Describe the real-world scenario where it could fail.
3. Assess the severity (Critical / High / Medium / Low).
4. Suggest a concrete improvement.

Do not invent problems just to be critical. If something looks suspicious but you're not confident, explicitly label it as a concern rather than a defect and explain what additional context would confirm or rule it out.

At the end, provide:

• Overall risk level for merging (Low / Medium / High).
• Top three changes you would request before approval.
• Whether you would approve, request changes, or leave comments only. :::

If you want even stronger results, include the PR description, relevant architecture context, and the expected behavior. LLMs produce much better reviews when they understand why the code exists, not just what it does.

You can also ask the model to review from a specific perspective, such as "review this like a staff engineer responsible for production reliability" or "assume this service handles millions of requests per day," to bias it toward deeper architectural and operational concerns.

Here's a version tailored to that focus:

:::writing{variant="document" id="32684"} Review this pull request with a focus on security, performance, correctness, and long-term maintainability.

Ignore style preferences, formatting, naming, and other minor nits unless they directly affect correctness or maintainability.

Prioritize finding:

• Security vulnerabilities, trust boundary issues, authorization/authentication flaws, input validation gaps, injection risks, sensitive data exposure, and unsafe assumptions.
• Performance problems such as unnecessary allocations, inefficient algorithms, excessive I/O, N+1 queries, locking/contention, blocking operations, memory usage, and scalability concerns.
• Correctness issues including edge cases, race conditions, error handling, data consistency, resource leaks, retry/idempotency problems, and behavior that may diverge from the intended requirements.
• Maintainability concerns such as overly complex logic, hidden coupling, fragile abstractions, duplicated business logic, technical debt, and designs that will be difficult to extend safely.

For each issue:

1. Explain why it matters.
2. Describe a realistic failure scenario or impact.
3. Rate the severity (Critical / High / Medium / Low).
4. Suggest a concrete fix or alternative approach.

Do not invent issues. If something appears risky but cannot be confirmed from the available code, clearly label it as a potential concern and explain what additional context would be needed.

At the end, summarize:

• Merge risk: Low / Medium / High.
• The top 3 issues that should be addressed before merging.
• Whether you would Approve, Request Changes, or Comment Only, with a brief justification. :::

This tends to produce more actionable reviews by steering the model toward substantive engineering risks instead of cosmetic feedback.

They're complementary. The biggest difference is that LLMs are excellent at breadth and pattern matching, while humans are better at context, intent, and judgment.

LLMs excel at	Humans excel at
Scanning large diffs quickly	Understanding product intent and business requirements
Finding common security mistakes	Knowing whether the implementation solves the right problem
Spotting performance anti-patterns	Evaluating architectural tradeoffs
Identifying missing edge cases	Understanding historical context and prior incidents
Suggesting test cases	Recognizing organizational constraints and roadmap implications
Consistent, tireless review	Making nuanced risk/benefit decisions

Where LLMs often outperform humans

• Coverage. They don't get tired after reviewing 2,000 lines of code.
• Pattern recognition. They're good at recognizing known bug patterns (race conditions, null handling, SQL injection risks, resource leaks, etc.).
• Cross-file reasoning. Given enough context, they can connect changes across multiple files more consistently than a rushed reviewer.
• Review speed. They can generate an initial review in seconds, allowing humans to focus on higher-value discussions.

Where humans still have a clear advantage

• Intent. "Is this actually what the customer asked for?"
• Domain knowledge. Understanding regulatory requirements, internal APIs, legacy constraints, or unwritten team conventions.
• Architecture. Deciding whether a design is appropriate for the system's future evolution.
• Risk assessment. Knowing when an imperfect solution is acceptable versus when it needs redesign.

Where LLMs fail most often

• False positives. They may confidently flag issues that aren't actually problems because they lack context.
• Invented assumptions. They sometimes infer requirements that don't exist.
• Overengineering. They may recommend abstractions or optimizations that add unnecessary complexity.
• Limited runtime understanding. They can't execute the code or observe production behavior unless you provide logs, tests, or execution traces.

Where humans fail most often

• Review fatigue. After many reviews, it's easy to miss subtle issues.
• Tunnel vision. Focusing on one area while overlooking another.
• Inconsistent scrutiny. The depth of review can vary depending on time pressure or familiarity with the author.
• Style discussions. Reviews sometimes get sidetracked by formatting or personal preferences instead of substantive issues.

A workflow that works well

A strong process is:

1. Have an LLM perform a first-pass review focused on correctness, security, performance, and maintainability.
2. Ask it to generate targeted test cases and identify assumptions.
3. Have a human reviewer evaluate whether the implementation is the right solution, verify any flagged issues, and assess design tradeoffs.
4. Use the LLM again to explore fixes or alternative implementations if changes are needed.

In practice, LLMs are most valuable as a reviewer that never gets fatigued and can systematically inspect a PR. Human reviewers remain essential for deciding what the code should do, weighing tradeoffs, and validating that the implementation fits the broader system and product goals.