3 AI code review prompts to catch edge cases

Most review bots stop at style and obvious bugs. These three prompts force the model to hunt the cases that actually break in production.

Use them as-is in your PR comments, or drop them into your review agent system prompt.

1. Boundary and empty-state hunter

You are reviewing this diff for edge cases, not style.

For every changed function:
1. List inputs that are empty, null/undefined, zero, max-int, or one-off the happy path.
2. For each, say whether the new code handles it, panics, or silently returns wrong data.
3. Flag any loop or pagination that assumes at least one item.
4. Flag any parse/deserialize that assumes a well-formed payload.

Reply with a table: location | input | current behavior | risk (high/med/low) | suggested guard.
Do not rewrite the whole file. Only cite the lines you reviewed.

2. Concurrency and retry trap

Review this diff for races, double-submit, and retry hazards.

Check:
- Shared mutable state without a lock, mutex, or atomic
- Check-then-act on caches, DB rows, or feature flags
- Idempotency: what happens if this handler runs twice with the same request id
- Timeouts that leave a half-written side effect
- Webhooks or jobs that can arrive out of order

For each issue: file:line, why it races, a minimal fix (lock, upsert, idempotency key).
If nothing races, say so and name the invariants you relied on.

3. Authz and tenant-leak check

Review this diff for authorization and data isolation.

Assume a hostile caller who already has a valid session in another tenant.

Verify:
- Every new query/filter includes tenant/org/user id from the session, not from the request body
- IDs in URLs cannot be swapped to another tenant's resource
- Error messages do not confirm that a foreign resource exists
- Logs and traces do not print secrets, tokens, or PII from the payload

Output: pass/fail per endpoint or function, with the exact line that proves isolation or the line that leaks.

Wire these into your review bot as three sequential passes. One pass for boundaries, one for races, one for authz. Mixing them in a single prompt dilutes the findings.

For the complete library of 20+ production-tested prompt templates and automated review checklists, check out the full Miniforge AI Starter Kit here: https://whop.com/miniforge-ai-9ab4/miniforge-ai-starter-kit

3 prompts that catch subtle race conditions in AI-generated code

AI-generated code often looks correct and still fails under concurrent load. Use these prompts before you ship.

1. Shared mutable state

Paste the function and ask:

"List every shared mutable variable, cache, or collection this code touches. For each one, name the concurrent callers, the exact race (lost update, stale read, double-init), and a minimal fix with locks, atomics, or immutability. Flag anything that looks single-threaded but is invoked from request handlers or workers."

2. Async completion order

Paste the async flow and ask:

"Trace every await, callback, and fire-and-forget task. Identify races where completion order can change results: overlapping writes, cancelled work that still mutates state, or two in-flight requests for the same key. Show a sequence diagram of the failure and a rewrite that is order-safe."

3. Check-then-act gaps

Paste the guard logic and ask:

"Find every check-then-act pattern (exists, then insert; if unlocked, then lock; read flag, then write). Show how another goroutine, thread, or request can interleave between the check and the act. Replace each with a single atomic operation or a transaction, and note remaining TOCTOU windows."

Run all three on the same PR. If any prompt returns a race you cannot reproduce locally, treat it as real until you prove otherwise.

Want the full 20-prompt suite for production AI engineering? Get the complete Miniforge AI Starter Kit: https://miniforge-ai-store.whop.site