AI-Assisted Code Review: Real Feedback After One Year

# AI caught: SQL Injection
def get_user(request, user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    # AI comment: ⚠️ Directly concatenating user input into SQL, SQL injection risk
    # Suggestion: use parameterized query

# AI caught: missing boundary condition
def calculate_discount(price, discount_percent):
    if discount_percent > 100:
        return 0  # this check exists
    
    # but missing: price < 0 case
    return price * (1 - discount_percent / 100)

# AI comment: ⚠️ price could be negative, not handled

# AI caught: this code is nearly identical to process_order above
# Suggestion: extract common function
def ship_order(order_id):
    # 97% duplicate with process_order
    pass

# AI didn't catch this (but it's actually a bug)
def apply_coupon(order_total, coupon):
    if coupon.type == "percentage":
        return order_total * (1 - coupon.value / 100)
    # looks fine...
    return order_total

# But business rule is: coupon cannot exceed 50% of order_total
# AI doesn't know this business rule, so it missed it

# AI didn't flag performance issue (but one exists)
def get_user_orders(user_id):
    orders = db.query("SELECT * FROM orders WHERE user_id = ?", user_id)
    for order in orders:
        # each order queries user separately
        user = db.query("SELECT * FROM users WHERE id = ?", order.user_id)
        order.user = user
    return orders

# AI didn't catch this as N+1 (queries = 1 + N)

After PR submitted:
  1. AI Review Bot auto-analyzes diff
  2. Comments on PR (by priority)
     - 🔴 P1: Security vulnerability (block PR)
     - 🟡 P2: Logic/edge issues (suggest fix)
     - 🟢 P3: Code style (optional)
  3. Human reviewer only checks P1 and P2
  4. P3 suggestions: developer decides