# The Critical Role of Code Review in Software Quality Assurance - Canonical: https://33rdsquare.com/the-critical-role-of-code-review-in-software-quality-assurance/ - Published: 2024-03-06 - Author: Brian Lucas - Categories: [App & Browser Testing Automation](https://33rdsquare.com/category/browser/browser-testing/) --- As an seasoned quality assurance leader who has tested complex software systems across every major platform and mobile device over my 10+ year career, I cannot overstate the massive positive impact that a disciplined code review program has on shipping high-quality, resilient software. After seeing many projects derailed by quality issues originating from avoidable coding mistakes, I now evangelize code reviews as a non-negotiable best practice for any team serious about institutionalizing quality. This comprehensive guide draws from painful lessons learned across thousands of hours reviewing code to help your team incorporate reviews for catching the subtle bugs that evade testing. I’ll share actionable advice for making code review a cornerstone of your quality assurance efforts without slowing development velocity. Let‘s dive in! ## What Makes Code Review So Valuable? Code reviewing refers to developers and testers manually evaluating source code written by their colleagues, looking for any assumptions made, hidden corner cases overlooked, or very small issues like typos which can later manifest into catastrophic runtime errors. Multiple studies have shown that code reviews catch 15-35% more defects pre-release than testing alone, resulting in: - 10-30% decrease in total defects long term - 5-10X savings fixing bugs during code vs in production - 21X ROI for every hour invested, per IBM By thoroughly reviewing code changes soon after they are written, issues get flagged rapidly compared to waiting for lengthier testing cycles. Let‘s walk through how to make code review work effectively. ## Who Should Participate in Code Reviews? I recommend involving at least 3-4 diverse reviewers for maximum benefit, including: - The developers who authored the code - Developers familiar with this part of the codebase - QA engineers - Architects - Security experts for risky code This variety of perspectives results in more learned questions, hidden assumptions uncovered, better solutions brainstormed, and knowledge shared across the full team. ## When Should Code Reviews Happen? Don‘t wait to review one gigantic 1000 file pull request right before release! Reviewing smaller batches of code continuously leads to fewer issues slipping through the cracks. I advise teams to integrate mandatory code reviews as a standard phase of development before changes are merged to the main code branches. Reviews should take place frequently, assessing incremental batches of code multiple times per week. This tight feedback loop results in authors having context on recently changed code, and prompt correction of any style or architectural deviations before too much technical debt accumulates. ## Checklists Are Key for Consistent, Thorough Reviews It‘s painfully easy for even experienced developers to miss subtle issues during reviews due to fatigue or assumptions. Using a standardized code review checklist for every review session greatly reduces this risk. Some key things for all reviewers to check include: - Formatting and naming aligned to project conventions - No hardcoded credentials/keys - No disabling of error handling logic - No unvalidated data ingestion paths - No unnecessary code complexity Leverage checklist templates and customization to make reviews rigorous yet consistent across the team. ## Types of Code Review Models Let‘s explore some proven review models that thousands of teams use daily: **Pair Programming:** Two developers author and assess code together in real-time. Provides continuous feedback to improve design. Costly in developer time. **Email Pass-Around:** Code under review is emailed to multiple reviewers. Scheduling meetings is avoided but collaboration is limited. **Over-The-Shoulder:** Authors walk reviewers line-by-line through code interactively. Extremely high bandwidth conversations support knowledge sharing. **Tool-Assisted:** Specialized platforms like CodeScene facilitate commenting directly within the code being reviewed. Great for distributed teams. Determine which option(s) strike the right balance for your team based on codebase size, staffing constraints and risk tolerance. Now that we‘ve covered the basics, let‘s dig deeper. The rest of this guide provides actionable recommendations for QA testers and developers to incorporate highly valuable code reviews. ## Twelve Code Defects Frequently Caught By Reviews Here are some examples of serious code flaws I have uncovered during reviews of applications that otherwise passed functional testing: 1. Disabling of parameter validation checks for dangerous method 2. Credentials hardcoded in mid-tier service callable by frontend 3. Race conditions from improper thread handling 4. Assuming IDs will always be positive integers 5. Null checks omitted that could cause crashes 6. Allowing paths for SQL injection attacks 7. No size limits imposed on input data 8. Using fixed size buffer without overflow checks 9. Deadlocks due to inconsistent lock ordering 10. Implicit data truncation errors swallowing digits 11. Resource leaks from exception handling anti-patterns 12. Code comments that actually contradict logic These types of easily-made mistakes underline why consistent code review is so critical for every quality-focused team. Both manual testing and even extensive automated checks can still overlook many categories of these systemic architectural and programming errors. Let your reviewers be the safety net catching bugs before customers do! ## Secure Code Deserves Extra Strict Reviews While all code should undergo peer review, extra scrutiny is warranted for security-sensitive code, including: - Application data access layers - Authentication and authorization modules - Networking communication modules - Input validation routines - Session management, cryptography and secrets management - External integrations with APIs/services Security experts should analyze changes in these areas to ensure no vulnerabilities are introduced. Implementing extra review gating for high risk code is proven to reduce exploitable defects. ## Lightweight Versus Heavyweight Code Reviews Code reviews come in all shapes and sizes depending on context. Your team should be fluent in "lightweight" daily reviews up through lengthy "heavyweight" reviews of the most critical subsystems. **Lightweight Reviews** entail quick sessions inspecting a few hundred lines of simple, isolated changes. Authors walk through diffs highlighting touch points with existing logic and changed assumptions. Lightweight reviews happen very frequently, providing rapid feedback to developers. **Heavyweight Reviews** are multi-hour slugfests conducted over multiple sessions to pore through architectural shifts or large risky modules with immense scrutiny. They require significant coordination and rigor to complete but result in very high quality implementations. Reserve heavyweights for major merges or your shakiest legacy code! ## Automated Checks Complement Manual Review In massive legacy codebases, manual review alone struggles with massive submit queues and zero context on distant modules. Smart tools like CodeMR and CodeScene statically analyze changes and add inline commentary automatically on stylistic issues, faulty patterns, suspicious logic and complex areas needing attention. These automated insights supplement human review to handling review overload. Integrate such assistants into your developer workflow to offload the tedium of checking minutiae like style guide adherence. This frees precious meeting time for reviewers to focus on big picture design tradeoffs and testability rather than mechanical syntactic glitches. ## Now Put These Tips into Practice! The case for code review is clear. As you institutionalize reviews with your team, remember: - Integrate reviews in standard workflow before merging changes - Analyze code frequently in small manageable batches - Involve diverse Dev, QA and Security experts - Leverage checklists to maintain consistency - Automate menial style checks to focus session time on substantive design Properly done code reviews substantially increase product quality via early detection of preventable issues in development rather than after launch. The data is irrefutable that short term time investments repay exponentially in cost savings and faster deliveries over the application lifespan. I‘m happy to offer tailored hands-on help introducing lightweight through heavyweight reviews using the proven techniques detailed here. Just reach out! --- Source: [The Critical Role of Code Review in Software Quality Assurance](https://33rdsquare.com/the-critical-role-of-code-review-in-software-quality-assurance/)