Advanced
Best Gemini Prompt for Code Review
Why Gemini?
Gemini performs structured code reviews across security, performance, maintainability, and correctness dimensions simultaneously, providing prioritized findings with line-level specificity.
Prompt Template
Perform a thorough code review of the following code.\n\nContext:\n- Language / framework: {language_framework}\n- Purpose of this code: {code_purpose}\n- This code will be: {deployment_context} (e.g., public-facing API, internal tool, open-source library)\n- Review focus areas: {focus_areas} (e.g., security, performance, or "full review")\n\nCode to review:\n{code}\n\nReview criteria — find issues in ALL applicable categories:\n1. Security vulnerabilities (injection, auth bypass, data exposure, input validation)\n2. Performance bottlenecks (N+1 queries, blocking I/O, memory leaks, inefficient algorithms)\n3. Correctness bugs (off-by-one errors, race conditions, incorrect logic)\n4. Error handling gaps\n5. Code maintainability (naming, complexity, duplication, missing abstraction)\n6. Test coverage gaps\n\nFormat output as:\n- CRITICAL (must fix before deploy)\n- HIGH (fix in current sprint)\n- MEDIUM (address in next sprint)\n- LOW (style / nice-to-have)\n\nFor each finding: location → issue → why it matters → specific fix. Example Output
CRITICAL: password compared with == instead of secrets.compare_digest — timing attack vulnerability. Line 34. HIGH: SQL query uses f-string interpolation — SQL injection risk. Line 67. MEDIUM: no rate limiting on /login endpoint. LOW: variable name 'l' is ambiguous on line 89.
Make it yours
Your Generated Prompt
Prompt copied! What's next?
Got your AI output? Make it better.
Paste what Gemini generated into Coda One — free, no signup.
Tips for Better Results
Paste the full file including imports — security issues often originate in how libraries are initialized or which version is imported. Ask for a second pass focused only on CRITICAL items if the full list is overwhelming.
Example (filled in)
Python FastAPI, User authentication endpoint, Public-facing API, Full review, [150-line auth route pasted]