Ask an AI to “review this code” and you usually get an essay: naming tips, a reminder about tests and a refactor nobody asked for. A good review prompt narrows the job down to what you actually need right now. The prompts in our code collection all start from that idea.
The two changes that make the biggest difference are ranking issues by severity and asking for a diff instead of a rewrite. Both are easy to add to any prompt, and they pair well with the context brief we described earlier.
The default prompt and its problem
Review this code and suggest improvements.
This gives the model no priorities and no stopping point. It will happily comment on everything, and the one real bug ends up as point seven of twelve.
A review prompt that stays focused
Review the code below for a pull request.
Focus only on:
1. Bugs and incorrect behaviour
2. Security issues (input validation, escaping, permissions)
3. Performance problems that matter at {{expected_scale}}
Ignore style and naming unless they hide a bug.
For each issue give: severity (high / medium / low), the line,
one sentence explaining the problem, and the fix.
Then output a unified diff with only the high-severity fixes.Why a diff beats a rewrite
A full rewritten file hides what changed. A diff shows it at a glance, and you can apply it with git apply or copy only the lines you agree with. It also stops the model from “improving” unrelated code along the way.
--- a/src/Export.php
+++ b/src/Export.php
@@ -42,7 +42,7 @@
- $file = $_GET['file'];
+ $file = sanitize_file_name( wp_unslash( $_GET['file'] ?? '' ) );
if ( ! current_user_can( 'export' ) ) {Severity levels keep the review honest
- High: wrong results, data loss or a security hole. Fix before merging.
- Medium: works now but will break under real load or edge cases.
- Low: worth a note, not worth blocking the merge.
If everything comes back as high, the model is padding. Add one line to the prompt: “If there are no high-severity issues, say so.”
The best AI review is the one that tells you there’s nothing serious, and means it.
Lead developer, after three months of AI-assisted reviews
Still review the review
AI reviewers miss things and sometimes invent problems that don’t exist. Treat the output as a second pair of eyes, not a gate. Run the tests and read the diff before you apply it.