Review Spring Boot code

Code review process

1. Check dependency injection style — flag any @Autowired on a field or setter; constructor injection only.
2. Check every JPA relationship's fetch type — flag FetchType.EAGER and any findAll()-shaped repository method returning entities with un-fetched collections (N+1 risk). For MySQL/PostgreSQL-specific persistence issues (ID generation strategy, driver, JSON column mapping), see spring-boot-jpa; for a MongoDB codebase, use its own review angle from spring-boot-mongodb instead of this JPA-specific checklist (@DBRef misuse and missing explicit indexes are the Mongo equivalents of N+1 and a missing index here).
3. Check API boundary — flag any controller method returning a JPA entity directly, or a @RequestBody bound directly to an entity, instead of a DTO record.
4. Check mutation endpoints for ownership/authorization — a user-scoped resource (e.g. editing a review, a comment) must verify the caller owns it, not just that they're authenticated.
5. Check security config for dead or wildcard matchers that no longer match any real route. For a deeper security audit (CORS, headers, secrets, rate limiting, CVE hygiene), load spring-boot-security alongside this skill rather than treating this item as exhaustive.
6. Check entity equals()/hashCode() — flag if they depend on the auto-generated @Id.
7. Check for hardcoded config (DB credentials, API keys, service URLs) instead of externalized @ConfigurationProperties.
8. Check test annotations against actual route protection — if a route's security requirement changed, its test must reflect the new requirement, or the test is silently passing against the wrong permission level.
9. Sweep for dead code (unused classes, unused dependencies in the build file).

Concurrency: optimistic locking

Any entity updated by concurrent requests (stock counts, balances, shared documents) should carry @Version: