Once a file passes linting, the review should shift from mechanical correctness to behavioral correctness. The file no longer needs another pass for indentation or naming. It needs a reviewer who can tell whether the change is safe, complete, and appropriate for the rest of the system.
Review the data flow
- Where does the input come from?
- Who can control it?
- Where does the output go?
- Could the file leak sensitive data along the way?
Review the control flow
A clean file can still take the wrong branch, skip an important condition, or fail open when it should fail closed. That is especially important for security-sensitive code, where one missing branch can mean a privilege escalation or data exposure.
Review the boundaries
- Authentication and authorization
- Configuration and environment variables
- Dependency updates and imports
- Error handling and logging
Review the user impact
A file is not done just because it is syntactically correct. Ask whether it helps the user, preserves the system’s invariants, and avoids introducing a new security or reliability risk. That is the real meaning of “ready to merge.”