Enterprise-Grade Codebase Review

A comprehensive, practical codebase audit methodology for projects of any size. Not every project needs every check — the tiered system ensures you apply the right level of rigor.

For the full detailed checklist, see references/detailed-checklist.md in this skill directory.

Binding rules

1. Run the pre-flight checklist before reviewing. Confirm which branch holds the current work (never assume main), what to exclude, whether a prior review exists, and the output format and audience; skipping it has wasted real engagements.
2. Score the project, then apply its tier's checks. No Tier 4 scrutiny for a weekend project, and no skipped Tier 1 basics for an enterprise system.
3. Every finding cites file paths and line numbers and gives concrete remediation steps.
4. Strengths before findings in every report, so critical findings land as guidance rather than an attack.
5. Use delta mode when a prior review exists. Classify each earlier finding as Fixed, Partially Fixed, Still Present, Worse or New, because a trajectory is more useful than a list of problems.
6. Secrets scanning is critical at every tier.
7. Checklist items are practical and checkable: each catches real issues and is worded so an AI assistant can evaluate it.

Contents