## Critical Security & Correctness
- [ ] No hardcoded secrets, API keys, or credentials
- [ ] Authentication check present on all protected endpoints
- [ ] Authorization check present (not just authentication)
- [ ] User input validated and sanitized before use
- [ ] No SQL/NoSQL injection vectors (parameterized queries only)
- [ ] Error responses don't leak internal details (stack traces, DB schema)
- [ ] Sensitive data not logged (passwords, tokens, PII)

// AI generated (vulnerable)
app.get("/api/invoices/:id", requireAuth, async (req, res) => {
  const invoice = await prisma.invoice.findUnique({
    where: { id: req.params.id },
  });
  return res.json(invoice);
});

// Fixed (checks ownership)
app.get("/api/invoices/:id", requireAuth, async (req, res) => {
  const invoice = await prisma.invoice.findUnique({
    where: { id: req.params.id, userId: req.user.id },
  });
  if (!invoice) return res.status(404).json({ error: "Not found" });
  return res.json(invoice);
});

## Architecture & Patterns
- [ ] Follows existing project error handling pattern
- [ ] Uses established data access layer (not direct DB calls in routes)
- [ ] Imports use project aliases (@/) not deep relative paths
- [ ] No new dependencies added without team approval
- [ ] File placed in correct directory per project structure
- [ ] No duplicate logic (search codebase for similar functions)
- [ ] Follows existing naming conventions (files, variables, functions)
- [ ] Uses existing shared utilities instead of reimplementing

## Edge Cases & Error Handling
- [ ] Null/undefined inputs handled explicitly
- [ ] Empty arrays and empty strings considered
- [ ] Boundary conditions tested (exactly at limit, one above, one below)
- [ ] Network failure handling present (timeouts, retries, fallbacks)
- [ ] Concurrent access considered (race conditions, double submissions)
- [ ] Errors propagated correctly (not swallowed with console.log)
- [ ] Partial failure scenarios handled (what if step 2 of 3 fails?)

## Performance
- [ ] No N+1 query patterns (use include/join instead of loops)
- [ ] Database queries use appropriate indexes
- [ ] Large datasets paginated (no unbounded findMany/SELECT *)
- [ ] Promise.all used for independent async operations
- [ ] No blocking operations in request handlers
- [ ] Response payload size reasonable (no over-fetching)

// AI loves this pattern (N+1 queries)
const users = await prisma.user.findMany();
const usersWithPosts = await Promise.all(
  users.map(async (user) => ({
    ...user,
    posts: await prisma.post.findMany({ where: { authorId: user.id } }),
  }))
);

// What it should be (1 query)
const usersWithPosts = await prisma.user.findMany({
  include: { posts: true },
});

## Test Quality
- [ ] Tests verify behavior, not implementation details
- [ ] Edge cases from above have corresponding tests
- [ ] Error/failure paths tested (not just happy path)
- [ ] Mocks are minimal (only external dependencies mocked)
- [ ] Assertions are specific (not just "toBeDefined")
- [ ] Test descriptions clearly state expected behavior
- [ ] No tests that mirror the implementation logic

<!-- .github/pull_request_template.md -->
## AI Code Review Checklist
(Check items you've verified. Leave unchecked items with a note.)

- [ ] No hardcoded secrets or credentials
- [ ] Auth and authorization checks present
- [ ] Follows existing codebase patterns
- [ ] Edge cases handled
- [ ] Tests verify behavior, not implementation