Definition and guide

Code review

Code review is a systematic software quality assurance technique for developers in which the code is reviewed to find and fix errors, improve code quality, and enforce coding standards.

Code review is the practice of systematically examining source code to identify defects, ensure adherence to standards, and share knowledge across the team.
Effective code review combines three layers: human judgment on logic, design, and intent; deterministic static analysis for objective quality and security checks; and, increasingly, agentic AI review that reasons about context and intent.
Automated code review with static analysis tools complements peer review by catching common bugs and vulnerabilities before reviewers invest their time.
AI code review goes further: it reads a change the way a person would, and the most advanced tools generate and commit real fixes rather than just flagging issues.
SonarQube automates detection of objective code quality and security issues with algorithmic, auditable analysis. Gitar AI Code Review adds agentic reasoning that catches functional and logic issues, analyzes the build and iterates until the CI passes - together freeing human reviewers to focus on higher-order judgment calls.

Code review is a software quality assurance process where one or more persons or tools systematically examine and evaluate the source code of a program. One or more of the individuals reviewing the code need to read the code and identify any issues within the code.

The goal of code reviews is to identify bugs, improve code quality, and follow best practices and standards for coding.

Code reviews are typically performed before integrating the code into the main branch of the codebase and can also be done periodically for existing code to maintain its quality over time.

The process of code review helps catch errors early in the software development lifecycle (SDLC), fosters collaboration among team members, and ultimately leads to a more robust and reliable software product.

There are code review tools that can assist with automating the review process. These review tools can check for coding errors and provide recommendations for improving the code.

If the code review is performed manually, at least one of the individuals should not be the author of the code.

Peer code review is a software development process in which one or more developers examine code generated by a peer before merging it into the main repository. This method is intended to improve software quality, detect defects and vulnerabilities early, share expertise among team members, and ensure coding standards are followed.

Peer code review can be done in a variety of ways, but the primary method is for the reviewer to read the code and look for errors. The code reviewer may also question the author about the code in order to better grasp its intent.

An automated code review is a process in which static code analysis tools or AI code review tools are used to automatically review and analyze the source code for potential issues and coding standard violations. Automated code review accelerates the identification and resolution of code issues and improves code quality (reliability, security, maintainability).

Different from peer review where a human is manually looking through code line by line, automated code reviews utilize tools to detect a wide range of errors from bugs and vulnerabilities to styling issues. As compared to manual peer review, automated code review tools can quickly and efficiently scan codebases to identify defects, security vulnerabilities, coding style violations, and other potential problems.

Some common issues normally highlighted with automated code review tools include:

Syntax errors
Logic errors
Security vulnerabilities
Code style violations
Compliance with coding standards

Common issues seen with automated code review tools

These kinds of code inspections are essential in current DevOps and Continuous Integration/Continuous Deployment (CI/CD) processes.

AI code review is a newer category that uses large language models and agentic reasoning — rather than a fixed rule set — to evaluate a change. Instead of matching code against a catalog of known patterns, an AI code review tool reads a pull request closer to the way a person would: it builds context from the surrounding codebase and team conventions, then looks for issues that only make sense in that context — logic errors, incorrect assumptions, missed edge cases, and behavior that technically compiles but doesn't do what the author intended.

The most advanced tools in this category go a step further than leaving comments. Agentic AI code review platforms, such as Gitar AI code review, don't just flag a problem — they generate a working fix, and commit it to the branch. Gitar also monitors CI pipelines directly, roots out the cause of failing builds, and posts a fix or a clear explanation of what broke and why,and then iterates until the build passes, all without the developer leaving their pull request.

AI code review doesn't replace deterministic static analysis or human review — each looks at the code through a different lens:

Deterministic static analysis (for example, SonarQube) checks code against a defined rule set and quality gate: consistent, fast, fully auditable, and unaffected by how the code was written.
AI code review (for example, Gitar AI code review) reasons about intent and context, catching functional and behavioral issues a fixed rule set can't anticipate, and can act on what it finds by proposing and committing fixes.
Human reviewers weigh in on architecture, trade-offs, and product intent — decisions that require judgment no tool fully automates.

Code review is an important method for increasing software quality. It can aid in the detection of defects and errors, the improvement of code readability, security, and maintainability, and the exchange of knowledge early in the development process. By implementing code reviews earlier in the development life cycle, you can save time and money later on in the process.

By utilizing code reviews earlier on also, it can be made easier for future developers to work on and understand the code that is evaluated. This helps promote knowledge and collaboration among team members along with fostering shared code ownership.

Secure code review is a subset of code review that focuses on detecting potential security flaws and weaknesses in a codebase. Its goal is to ensure that the application’s codebase is resistant to potential security threats and follows secure coding practices. It's a proactive strategy that aids in the detection and correction of security flaws before the application goes live. This can prevent attackers from exploiting weaknesses in the code.

Secure code review can be performed manually, by a security professional or developer reviewing the code line by line, or automatically, with secure code review tools that scan the code and flag errors. The code reviewer looks for common security issues in the code such as injection flaws, Cross-Site Scripting (XSS) vulnerabilities, and authentication and authorization issues.

Secure code review is an important aspect of the software development lifecycle (SDLC) since it can assist in identifying and correcting security flaws before they are exploited by attackers. The reviewer looks over code to identify known vulnerabilities like those mentioned in the OWASP Top 10 along with concerns unique to the application or dev environment.

Typically, the process includes both manual and automated reviews. Manual reviews can evaluate the logic and design of the code, identifying issues that other tools may overlook. Automated tools rapidly scan vast codebases for common vulnerabilities and coding errors, increasing the efficiency of the review process.

Automated Code Review for AI Agents

Code reviews are an essential element of the software development process that can considerably improve the final product's quality.

Here's a step-by-step guide to performing a code review:

Set some time aside to become accustomed to the code before beginning the review. This includes reading the code, knowing its purpose, what the code is supposed to do, and comprehending the team's coding standards.

Understanding the goal and context of the code modification is critical.

You can begin the review once you are familiar with the code. The review should be a two-way dialogue between you and the code's author. You should ask the author questions regarding the code, and they should explain their decisions.

Determine whether the suggested solution is consistent with the application's existing architecture and design patterns. If the implementation diverges significantly, it is worthwhile to demonstrate why and how the alternate solution improves the project.

Ensure that the code functions as expected and achieves its intended goal. This could include manually executing and testing the code, examining automated test results, or simply confirming that appropriate testing was performed.

Look for any problems as you go through the code. This involves searching for logic mistakes, security flaws, performance difficulties, and readability issues.

The code should follow the coding style and standards of the team. Code style consistency makes the code easier to read and understand. This includes correct indentation, naming conventions, and code organization.

Code smells can indicate more serious issues in the code. Large classes or methods, redundant code, magic numbers, or excessive complexity are examples. If you notice a code smell, it's worth talking about and possibly refactoring.

The code should be easy to read and understand. Good code usually is self-explanatory.

Ideally, code changes should be accompanied by tests. Ensure that there is appropriate test code coverage and that the tests are testing the functionality correctly.

Analyze the code for possible security vulnerabilities and performance issues. If the code adds new features, make sure they don't have an adverse effect on the application's performance or security.

When you notice problems, give clear, constructive comments. Explain what's wrong, why it's a problem, and, if possible, provide a solution. Be courteous and professional in your remarks.

If you have any concerns or questions, don't be afraid to ask them. It is preferable to clarify uncertainty rather than make assumptions. Code review is more than just looking for bugs; it's also an opportunity for discussion and learning.

When you're through, write a summary of your findings. Depending on the conclusion of your review, you can approve the modifications, suggest revisions, or just include comments.

After reviewing your suggestions, the developer should be able to remedy the issues. This could include changing the code or justifying their decisions.

The purpose of a code review is not only to find problems but to promote sharing knowledge, cooperation and continuous learning with the team. When executed properly, code review may greatly enhance the quality of your code.

Steps like checking correctness, reviewing style and standards, spotting code smells, and evaluating security and performance can happen automatically and continuously: deterministic tools like SonarQube apply your quality gate on every commit, and agentic tools like Gitar AI code review automatically read the full pull request for functional and logic issues and commit fixes directly. That leaves reviewers more time for the parts of this list that stay inherently human — reviewing design intent, having the two-way dialogue with the author, and making the final call to approve.

Code review tools are software applications that help in the code review process. These tools work to improve the organization, efficiency, and effectiveness of code reviews by including capabilities such as side-by-side comparisons, automated analysis, commenting systems and integration with version control systems.

Here are a few factors to think about when selecting a code review tool:

The project's size and complexity. Larger and more sophisticated tasks may necessitate the use of more powerful tools.
The available budget. Some code review tools are open source and free, while others are not.
The functions provided by the tool. Some tools provide more features than others.
The tool's ease of use. Some tools are more user-friendly than others.

Code review tooling generally falls into three categories:

Version control platforms such as GitHub, GitLab, Bitbucket, and Azure DevOps, which use pull requests or merge requests as the mechanism for review.
Deterministic static analysis tools such as SonarQube, which apply a defined, auditable rule set and quality gate to every change.
AI-native review agents such as Gitar AI code review, which read a pull request in full context, flag functional and logic issues rule-based tools miss, and can generate and commit fixes directly on the branch.

Automated code review tools are software applications that analyze code automatically to find bugs, security flaws, and coding standards violations. These tools employ static code analysis, which examines the code without running it. The major purpose of these tools is to improve the efficiency of the code review process by spotting common errors, allowing human reviewers to focus on more difficult areas of the code.

The following are some benefits of utilizing automated code review tools:

An image listing out the benefits of automated code review tools

Automated code review tools can greatly enhance code quality by identifying common programming errors, code smells, and potential security vulnerabilities.

Automated code review tools assist in making the code review process more efficient. This is due to the fact that they can scan code far faster than a human reviewer across multiple codebases.

Automated code review tools can improve code review accuracy. This is due to their ability to detect potential flaws and weaknesses that a human reviewer may overlook.

These tools enforce the same rules to all code in the same way, ensuring that coding standards and guidelines are followed consistently throughout the project.

You can scale dramatically because these tools can handle code reviews for massive codebases where manual reviews cannot. They excel at such workloads and is one of the primary advantages of using automated tools.

Automated code review tools can reduce the risk of errors and vulnerabilities in source code. This is because they may detect possible issues before they are put into production.

Fixes, not just findings — the best in class examples generate a working patch and commits it, instead of leaving a comment for someone to act on later.
Context the rule set can't capture — reasons about what a change is trying to do, catching functional and behavioral issues static rules aren't written to find.
Closes the loop on CI — monitors pipelines, root-causes failures, and iterates on a fix until the build is green.
Faster time to trusted merge — shortens review cycles and reduces the back-and-forth that stalls pull requests, especially across time zones.

Code review sits at the center of how Sonar helps teams ship trusted software faster. Sonar brings together two complementary tools — SonarQube and Gitar AI code review — that, combined with your team's own judgment, cover the full spectrum of what a change needs before it merges.

SonarQube is Sonar's static analysis product for continuous code quality and security inspection, available as SonarQube Server (self-managed) or SonarQube Cloud (cloud-based, with automatic analysis and pull request decoration built in). It applies a consistent, auditable, algorithmic rule set across 40+ programming languages to catch bugs, code smells, and security vulnerabilities before merge, and supports custom rules and plugins so teams can extend it to their own standards. It works the same way regardless of who — or what — wrote the code.

Gitar AI code review is Sonar's agentic AI native code reviewer. It reviews every pull request with full context of the codebase and team conventions, catching functional bugs, logic errors, and behavioral issues that rule-based tools aren't built to see. When it finds a problem, it doesn't just comment — it generates a real fix and commits it to the branch. Gitar also monitors CI pipelines and automatically analyzes failures on every PR, identifying root causes and pushing fixes. It works across GitHub, GitLab, Bitbucket, and Azure DevOps, with feedback appearing inline on the lines that have issues, summarized in a dashboard comment, and grouped into a single review — no context switching to external tools.

SonarQube and Gitar look at the same code through different lenses. SonarQube's algorithmic, first-principles analysis is fast, consistent, and fully auditable; it doesn't assume AI-generated code is correct, and it verifies every change against your quality gates regardless of how the code was produced. Gitar adds contextual reasoning on top of that — understanding what a change is trying to do — and can act on what it finds by proposing and committing fixes. A green CI build alone doesn't mean code is production-safe; layering both approaches means more of what matters gets caught before it ships, closing gaps that neither approach closes alone.

Used together, they free human reviewers to spend their time where judgment matters most: architecture, trade-offs, and intent, rather than re-checking what a tool could have already verified.

Verify all code, then turn findings into fixes automatically. Start with Gitar in your PR, and pair it with SonarQube to find and fix issues faster.

Get started with SonarQube Install Gitar AI code review free

Build trust into every line of code

4.6 / 5

Get started Contact sales

Code Review FAQs

What does “nit” mean in a code review?

A nit in a code review is a minor, usually non-blocking comment about a small issue such as naming, formatting, or wording. “Nit” is short for nitpick. Reviewers often start these comments with “nit:” to tell the author that the point is optional and should not hold up approval. The label helps teams separate must-fix problems from small polish suggestions, and automated formatters and linters can handle many nits so that people can focus on bigger issues.

What are the most common mistakes in code review?

The most common code review mistakes are reviewing changes that are too large, focusing on style instead of logic and design, and giving vague or harsh feedback. Other frequent problems include unclear team standards, slow turnaround, rubber-stamp approvals, and skipping review of tests. Teams can avoid most of these by keeping changes small, automating style checks, writing specific and constructive comments, and agreeing on response times and approval criteria.

How do you reduce code review cycle time without sacrificing quality?

You reduce code review cycle time by keeping pull requests small and focused, writing clear descriptions, and running automated checks before a human looks at the change. Setting a team expectation for response time and assigning reviewers who know the affected code also helps. Quality holds up because reviewers spend their time on design, logic, and intent, while automation covers consistent, objective checks such as style, known bugs, and test results.

How do you scale code reviews across large teams?

You scale code reviews by spreading the work, automating objective checks, and keeping standards consistent. Use ownership rules so changes reach reviewers who know the area, rotate reviewers to avoid bottlenecks on a few senior developers, and publish shared guidelines so reviews feel consistent across teams and repositories. Automated checks remove repetitive feedback, and tracking review time shows where work is getting stuck.

How quickly should a pull request be reviewed?

A pull request should be reviewed quickly enough that the author does not lose context, and many teams aim for a first response within one business day. Small changes can often be reviewed much faster. Long waits stall work, increase merge conflicts, and make feedback harder to act on. Setting an explicit expectation, keeping pull requests small, and using notifications or review rotations helps teams keep a steady pace.

How do you automate code reviews without losing human oversight?

You automate code reviews by giving machines the objective, repeatable checks and keeping people on the judgment calls. Run automated scans, tests, and formatting checks on every pull request, and use quality gates to block changes that fail. AI can add summaries or suggested fixes. Keep a human approval step before merging, especially for sensitive or architectural changes, and review automated findings regularly to tune rules and reduce noise.

How do you run effective code reviews in distributed teams?

You run effective code reviews in distributed teams by making them work well asynchronously. Write pull request descriptions that explain what changed, why, and how it was tested, and set response-time expectations that account for time zones. Automated checks give instant feedback while reviewers are offline, and specific written comments reduce back-and-forth. Use a short call for complex disagreements, then record the decision in the pull request so others can follow it.

What makes code easy to review?

Code is easy to review when it is small, focused, readable, and well explained. Clear naming, short functions, consistent style, and limited complexity help reviewers follow the intent quickly, and relevant tests show how the change is expected to behave. A good description of what changed and why also helps. Separating refactoring from behavior changes makes it easier for reviewers to spot real risks.

How do code reviews help prevent technical debt?

Code reviews prevent technical debt by catching shortcuts, duplication, and design problems before they merge, when fixes are cheapest. Reviewers can question unclear logic, missing tests, and quick workarounds, and they can enforce shared standards so the codebase stays consistent. Paired with automated quality gates that check new code, regular review stops small issues from piling up into larger maintenance problems later.

SonarQube Cloud

SonarQube Server

SonarQube Advanced Security

Gitar

Sonar VortexNew

SonarQube Remediation AgentNew

SonarQube Hunter AgentNew

SonarQube for IDE

SonarQube CLI

Sonar MCP

SonarQube Claude Code Plugin

SonarQube Cursor Plugin

SonarQube Codex Plugin

SonarQube Antigravity Plugin

SonarQube GitHub Copilot CLI Plugin

AI code quality

AI code review

Developer-led security (DevSecOps)

Automated code review

Compliance & reporting

SDLC governance

Secrets detection

Supply chain security

Token optimization

All use cases

Agent Centric Development Cycle (ACDC)

AI solutions

Architecture management

Security solutions

Code quality solutions

ROI calculator

LLM leaderboard

SonarQube vs GitHub Code Quality

Healthcare

Financial services

Retail

Federal government

Our customers

Customer stories

Developer hub

Learning center

Commitment to open source

Community

Developer guides

SonarQube Server

SonarQube Cloud

SonarQube for IDE

Sonar Vulnerability database

Gitar

GitHub

Bitbucket

Azure DevOps

GitLab

See all

Java

JavaScript

Python

C#

See all

Blog

Glossary

Documentation

ROI calculator

Solution briefs

White papers

Onboarding hub

Learning center

Interactive demos

Community

SonarQube update hub

Developer Survey report

The State of Code

Coding Personalities of Leading LLMs

LLM leaderboard

About Us

Our customers

Partners

Events hub

Newsroom

CareersJoin us!