Code review

What it means

Code review is the checking of source code changes by another developer before they are merged into the main version of the software. The reviewer looks for bugs, security risks, unreadable parts and departures from team standards.

It usually happens in a Git-based code platform through a pull or merge request: the author proposes a change, the reviewer comments and approves only when it is right.

Besides catching bugs, code review spreads knowledge in the team. More people understand each part of the system, so the company does not depend on a single programmer.

How it works in practice

Code review complements automated tests and CI/CD, which verify that things work, while a human judges logic, design and readability. Together they form the basis of software quality.

In outsourced development the client can require mandatory code review and access to the change history. It shows how the supplier works and makes a later change of supplier easier.

In systems that calculate tax, payroll or prices, changes to calculations should also be reviewed by someone who understands the subject matter, not only by a programmer.

What to watch out for

Very large changes are hard to review, and reviewers often approve them as a formality. Smaller, frequent changes are better because errors actually get found.

Code review does not replace a security audit or penetration test. Vulnerabilities arising from the combination of several parts of a system are often invisible when reviewing a single change.