The 5-Pass Code Review Method

After reviewing 10,000+ PRs, here is the method that catches the most bugs:

**Pass 1: Intent** — Does the code match the PR description? Read the description first, then skim the diff.

**Pass 2: Logic** — Trace the happy path. Does the algorithm do what it claims?

**Pass 3: Edge cases** — Null inputs, empty arrays, concurrent access, integer overflow.

**Pass 4: Security** — SQL injection, XSS, auth bypasses, secrets in code, unsafe deserialization.

**Pass 5: Maintainability** — Naming, abstractions, test coverage, documentation.

Most reviewers do passes 1 and 5. The bugs live in passes 2-4.