Review question checklists
A fixed bank of questions a reviewer must answer for a kind of change, ranked so the most relevant ones are asked first.
Sub-techniques
3
| ID | Name | Description |
|---|---|---|
V1040.001 | Universal questions | Questions that apply to any change: error handling, tests, naming. |
V1040.002 | Behavioural questions | Questions about what changes for users and callers. |
V1040.003 | Security requirement checklists | Verification requirements per area from a standard such as OWASP ASVS. |
Craft it
- Start from a published checklist and keep only questions your reviews actually raise.
- Tag each question with the kinds of change it applies to.
- Rank by relevance to the diff and ask the top few.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- PR templates with checkbox lists, or review guidelines in CONTRIBUTING.md.
Open-source packages
3
- OWASP ASVS OWASP/ASVS
- Google engineering practices google/eng-practices
- rerankers AnswerDotAI/rerankers