Saoirse O'Sullivan
November 2025
16 minute read

In software development, code review is more than a quality gate—it's a collaboration ritual. Done well, it elevates code quality, spreads knowledge, and strengthens team culture. Done poorly, it breeds resentment, slows progress, and erodes trust.
This comprehensive guide teaches you code review best practices that focus on constructive feedback—not criticism. Learn how to deliver actionable insights with empathy, avoid common pitfalls, and foster a review culture where everyone grows. Whether you're a senior engineer mentoring juniors or a new developer giving your first review, these strategies will help you communicate clearly, kindly, and effectively.
Google’s Project Aristotle found that psychological safety is the #1 factor in high-performing teams. Harsh code reviews destroy that safety. Constructive ones build it.
Improve code quality and maintainability
Catch bugs early
Share knowledge and coding standards
Onboard new team members
Build team cohesion and trust
A 2023 Stack Overflow survey showed 78% of developers feel anxious during reviews. Your tone can change that.
Stop thinking of yourself as a judge. Start thinking like a coach.
Assume good intent – The author isn’t trying to write bad code
Focus on the code, not the person
Be specific and actionable
Balance praise and critique
Ask questions instead of making demands
Great reviews follow a predictable, kind structure. Use the SBI model (Situation–Behavior–Impact):
Situation: Where in the code?
Behavior: What did you observe?
Impact: Why does it matter?
Bad: "This function is too long. Fix it."
Good: *"In calculateTax(), the function is 120 lines long (Situation). This makes it harder to test and debug (Impact). Consider breaking it into smaller functions like validateInput(), applyDiscount(), and computeFinalAmount() (Suggestion)."
The classic "sandwich" (praise → critique → praise) works—if you avoid manipulation.
"Great job extracting the API client into its own module—this improves testability!"
"I love how you added JSDoc comments. It makes the intent crystal clear."
"The error handling here is solid—really appreciate the user-friendly messages."
Tip: Be specific. Generic "Good job!" feels hollow.
Instead of "You should do X", try "Have you considered Y?" This invites dialogue and respects the author’s expertise.
"What happens if the API returns a 429? Should we add retry logic?"
"Could we extract this logic into a custom hook to reuse in SettingsScreen?"
"Is there a reason we’re not using useMemo here? Just curious about the performance impact."
Bad: "Use 2 spaces, not 4."
Better: Let Prettier or ESLint handle style. Only comment if it affects readability.
Avoid debating variable names for 10 comments. Suggest once, then move on.
Best practice: Review small PRs (< 400 lines). Encourage incremental progress.
Let machines handle what they do best—so humans can focus on architecture, logic, and intent.
Prettier + ESLint → Auto-format and lint on commit
GitHub Actions → Run tests, type checks, and security scans
Codecov or SonarQube → Enforce coverage thresholds
Dependabot → Auto-update dependencies
Pro tip: Use "Request Changes" only for critical issues. Use "Comment" for suggestions.
Example: "All PRs under 200 lines reviewed within 4 hours. Larger ones within 24."
Prevents knowledge silos and reduces bias.
Use Slack or PR comments: *"This refactoring is textbook—thanks for making our codebase cleaner!"
Sometimes a 15-minute screen share prevents a 3-day review cycle.
Explain why something matters. Link to docs or past incidents.
"I see you chose Redux here—curious why not React Query? Open to discussing trade-offs."
Model the behavior you want to see.
Respond with "Thanks for catching that!" even if you disagree
Ask clarifying questions in thread, not DMs
Update the PR with a summary: "Fixed null check + added test case"
If you push back, explain why—not that you’re right
Does it work? (Run locally if needed)
Are there tests? Do they pass?
Is it secure? (SQLi, XSS, authz)
Is it readable and maintainable?
Does it follow team conventions?
Did I leave at least one positive comment?
Code review is a skill—and like any skill, it improves with intention and practice. By focusing on constructive feedback, leading with empathy, and automating the noise, you create a review culture where code gets better—and people do too.
Start today: Pick one PR, apply the SBI model, and ask a question instead of making a demand. Watch how fast your team’s trust and velocity grow.
Aim for under 30 minutes per review. If it takes longer, the PR is likely too big.
No. Let Prettier or ESLint auto-fix on commit. Only comment if it affects logic or readability.
Discuss in thread or pair up. If blocked, escalate to tech lead—not in public shaming.
1 for small changes, 2 for complex or cross-team impact. More than 3 slows momentum.
Yes! Tools like GitHub Copilot or DeepSource can catch bugs—but human empathy is irreplaceable.