Code review with severity levels

Review a diff and produce structured findings (bug, perf, style) with severities.

The prompt

Copy this verbatim. Replace the {{ … }} placeholders with your values.

<instructions>
Review the diff in <diff>. Produce a JSON array of findings inside <result> tags.

Each finding:
{
  "line": 42,                       // best-effort line in the new file
  "category": "bug | perf | security | style | docs",
  "severity": "info | low | medium | high | critical",
  "summary": "string, max 100 chars",
  "explanation": "string, 1–3 sentences",
  "suggested_fix": "string or null"
}

Rules:
- Only flag issues actually present in the diff. Do not speculate about the rest of the file.
- Severity "critical" is reserved for security issues or data corruption.
- Skip findings with severity "info" unless asked.
- If the diff is clean, return [].
</instructions>

<diff>{{ unified_diff }}</diff>

Return inside <result> tags.

Sample input

A diff that adds a function using string concatenation for SQL and ignores the return value of a write call.

Expected output

<result>
[
  {"line": 12, "category": "security", "severity": "critical",
   "summary": "SQL built via string concatenation — injection risk",
   "explanation": "User input is concatenated directly into the SQL query. Switch to parameterized queries.",
   "suggested_fix": "db.execute('SELECT * FROM users WHERE id = %s', (user_id,))"},
  {"line": 24, "category": "bug", "severity": "medium",
   "summary": "Write call result discarded",
   "explanation": "The return value of f.write() is not checked; on partial writes this silently truncates output.",
   "suggested_fix": null}
]
</result>

Notes & tuning tips

• Force JSON output; nothing else parses reliably from a code-review prompt.
• Cap the diff size — large diffs (>1000 lines) yield shallow reviews; chunk by file.
• Pair with a confidence threshold and post only severity ≥ medium to PR comments.

What this example uses

Tags: <instructions> <format>

Patterns: structured output

More like this