Fresh-Eyes Review
Overview
Deliberate re-reading of changed code with psychological distance. Catches what you assumed was correct.
Core principle: 100% test coverage can coexist with critical bugs.
Prerequisite: verification-before-completion must pass first.
Process
- Announce: "Starting fresh-eyes review of [N] files."
- Walk each changed file through the five checklists below.
- Fix immediately. Re-run tests after each fix.
- Declare: "Fresh-eyes complete. [N] issues found and fixed: [brief description of each]." Include this even for zero findings.
Checklists
Security
| Check | Look For |
|---|---|
| Injection | Unsanitized input in queries, commands, or templates |
| Path traversal | Unvalidated file paths, ../ sequences |
| Auth gaps | Unprotected endpoints, missing authorization checks |
| Secrets | Hardcoded credentials, tokens, or keys |
Logic
| Check | Look For |
|---|---|
| Boundaries | Off-by-one in indices, loops, pagination |
| Race conditions | Concurrent access to shared state |
| Null handling | Unguarded access chains that could throw |
| Error swallowing | Empty catch blocks, ignored rejections |
Business Rules
| Check | Look For |
|---|---|
| Calculations | Formulas matching requirements, correct rounding |
| Conditions | AND/OR logic correct, negations applied properly |
| Edge cases | Empty input, single item, zero, maximum values |
| Defaults | Sensible values when optional fields omitted |
Input Validation
| Check | Look For |
|---|---|
| Type checks | Expected types enforced at boundaries |
| Range checks | Numeric bounds, string lengths, array sizes |
| Format checks | Email, URL, date formats validated |
Performance
| Check | Look For |
|---|---|
| N+1 queries | Loops making individual database/API calls |
| Unbounded work | Missing limits on iterations, result sets, payloads |
| Resource leaks | Unclosed connections, streams, event listeners |
Resistance Patterns
| Rationalization | Reality |
|---|---|
| "Tests are comprehensive" | Tests validate design, not correctness |
| "I'm confident it's correct" | Confidence is inversely correlated with bugs |
| "It's just a small change" | Small changes cause large outages |
| "Partner is waiting" | 3 minutes now saves 3 hours debugging later |
| "Senior dev already approved" | They reviewed intent, not implementation details |
| "Production is blocked" | Rushing causes the outages being rushed to fix |
Red Flags — STOP
- "I already looked at this code while writing it"
- "The tests cover everything"
- "This is too trivial to review"
- "I just need to commit this quickly"