# Review checklist

Use only the sections relevant to the change.

## Correctness
- [ ] Conditions: `<` vs `<=`, `&&` vs `||`, negations, inverted early returns
- [ ] Null/undefined/empty: empty arrays, empty strings, missing optional fields, `0` treated as falsy
- [ ] Async: every promise awaited or intentionally not; errors caught; no fire-and-forget that can fail silently
- [ ] Concurrency: two requests at once (double submit, double charge), shared mutable state
- [ ] Dates/times: timezones, DST, end-of-month, inclusive vs exclusive ranges
- [ ] Numbers: integer overflow, float rounding (money must be integer cents or a decimal type), division by zero
- [ ] Strings: unicode, case sensitivity, trimming, encoding in URLs
- [ ] State: stale caches, missing invalidation after writes

## Security
- [ ] New endpoint/action: authentication AND authorization (can user A access user B's data by changing an id?)
- [ ] User input reaching SQL, shell, HTML, file paths, redirects, or outbound URLs is validated/escaped/parameterized
- [ ] No secrets, tokens or keys in code, logs, error messages or client bundles
- [ ] Webhooks verify signatures
- [ ] Rate limiting on auth, password reset, expensive or paid operations
- [ ] Dependencies added: well-known, maintained, pinned

## Data
- [ ] Migrations: reversible? lock big tables? drop or rename columns still in use?
- [ ] New queries have indexes for their WHERE/ORDER BY
- [ ] No N+1 (query inside a loop)
- [ ] Queries have limits/pagination
- [ ] Writes that must happen together are in a transaction

## Failure modes
- [ ] External calls: timeout set, failure handled, retry with backoff where safe (idempotent)
- [ ] User sees a useful error, not a blank page or a stack trace
- [ ] Logs include enough context to debug, without personal data

## Frontend
- [ ] Loading, empty and error states exist
- [ ] Forms: disabled while submitting (no double submit), validation messages
- [ ] Accessibility basics: labels on inputs, buttons are buttons, keyboard reachable
- [ ] Works on a 375px wide screen if user-facing

## Tests
- [ ] New behavior has a test that would fail without the change
- [ ] Edge cases from above are tested where risky
- [ ] Tests don't depend on real time, network or order