reviewer

# Reviewer

Verified code review. Every finding must cite file:line and be confirmed by reading the actual code.

## Trigger

Use before committing, for PR reviews, security audits, or after major changes.

## Verification Protocol

**RULE: Never report a finding you have not verified against the actual code.**

For every potential issue:

1. **Read the code** — Open the file, read the specific lines
2. **Confirm it exists** — Quote the exact code that has the problem
3. **Check context** — Is there a reason for this pattern? (framework convention, upstream constraint, deliberate choice)
4. **Verify the fix is possible** — Don't suggest changes that break something else

If you cannot confirm a finding by reading the code, drop it.

### What "verified" means

- You READ the file at the specific line number
- You can QUOTE the problematic code
- You checked whether the pattern is used intentionally elsewhere
- You did NOT assume the code does something without reading it

### What "unverified" means (never report these)

- "This might have an issue with..." (you didn't check)
- "Ensure that X handles Y" (you didn't read X)
- "Consider adding validation for..." (you don't know if it already exists)
- "This could lead to..." (you didn't trace the code path)

## Checklist

For each file in the diff:

1. **Logic** — Read the function. Does the code path produce the correct result? Trace it.
2. **Edge Cases** — What happens with null, empty, zero, max values? Read the guards.
3. **Errors** — Follow the error path. Where does it go? Is it caught?
4. **Security** — Grep for user input flows. Check sanitization at each step.
5. **Performance** — Count loop nesting. Check data structure sizes.
6. **Tests** — Do tests exist for the changed code? Do they test the right behavior?

## Output Format

```
## Review: [Files/PR]

### Critical (must fix)
- **file.ts:42** — `user.role === "admin"` grants access but `user.role` can be undefined when session expires. Confirmed: line 42 has no null check, and `getSession()` at line 38 returns `null` on timeout.
  **Fix:** Add `if (!user?.role)` guard before the check.

### High (should fix)
- **api.ts:115** — SQL query uses string interpolation: `WHERE id = ${id}`. The `id` param comes from `req.params.id` (line 108) with no sanitization.
  **Fix:** Use parameterized query: `WHERE id = $1`.

### Verified Clean
- Error handling: All try/catch blocks properly propagate errors
- No console.log or debug statements found (grepped)
- No hardcoded secrets (grepped for password, secret, key, token)

### Approved?
[Yes/No with conditions]
```

## Rules

- Never report a finding without reading the actual code first.
- Never assume code behavior — read and quote it.
- Never say "ensure" or "consider" or "might" — either it's a problem or it's not.
- Grep before claiming something is missing (tests, error handling, validation).
- Suggest concrete fixes with file:line, not abstract advice.
- If the diff is clean, say so. Don't invent findings to justify the review.