Using AI to Review Code Instead of Writing It
The highest-value use of AI I have found is not generating code — it is a second read of code I already wrote, with prompts aimed at specific failure modes.
Everyone talks about AI writing code. I get more value from it reading mine. Review has a property generation does not: I already understand the code, so I can evaluate every suggestion instantly.
Ask About One Failure Mode at a Time
"Review this code" produces a shallow list. Narrow prompts produce real findings:
- "What inputs would make this throw? Include null, empty array, and out-of-range values."
- "Where can this leak data belonging to another user?"
- "Which of these queries runs inside a loop?"
- "What happens if this third-party call times out halfway through?"
Ask It to Argue Against the Code
"Assume this has a bug. Where is it?" is a surprisingly effective framing. It shifts the model from summarising to hunting, and it produces specific claims you can check rather than general praise.
Give It the Context It Needs
A method reviewed in isolation gets isolated feedback. Include the model, the migration and the calling code, and you get review comments about the interaction between them — which is where the real bugs live.
Have It Enumerate Test Cases
"List every edge case for this date-range function" reliably surfaces the two I skipped: the same-day range and the timezone boundary. Whether or not I use its code, that list is worth having.
Where It Is Weak
- Cross-file reasoning — it will not notice that another controller already does this differently.
- Your domain rules — it cannot know that bookings must never overlap for the same instructor unless you tell it.
- False positives — it will flag correct code confidently. Verify before you change anything.
It Does Not Replace Human Review
A colleague reviews for whether the approach fits the system and the team. AI reviews the code in front of it. Use it for the first pass, so human attention goes to the things only a human can judge.