A Pre-Commit AI Review Workflow That Catches What Local Tests Miss
Local test passes and green CI pipelines create false confidence — they rarely exercise missing auth checks, parameterized-query gaps, or error-message leaks. Adding a structured AI review step before human review catches those classes of bugs at the cheapest moment, and the diff-based approach keeps the model focused on what actually changed instead of re-litigating the whole codebase.
Running code without errors does not mean it is correct. A Node.js/Express user-registration endpoint that starts fine can still carry SQL injection, plain-text passwords, role-escalation holes, and raw database errors leaked to the frontend. Feeding the full requirements, business rules, and a git diff to an LLM before commit catches those problems early, when fixes are cheap.
The workflow centers on a detailed prompt that specifies project background, business constraints, and a structured output format — problem location, severity, impact, and a suggested fix — without letting the model rewrite the whole file. After the AI returns findings, the developer triages them into high (injection, auth bypass, data loss), medium (missing validation, unclear errors), and low (naming, style) buckets, then fixes and re-tests before pushing for human review.
A companion pre-commit checklist covers functionality, security, and engineering hygiene: verifying requirements, handling nulls and duplicates, checking for committed secrets, deleting debug logs, and confirming no unrelated files slipped into the change. The core rule is that AI finds candidates; the developer decides what is real, what matters, and how to fix it.
The biggest value of pre-commit AI review is not finding clever bugs but surfacing omissions — the empty-username case, the missing hash, the role field the client shouldn't control — that a passing local run never exercises.
Forbidding the model from rewriting the whole file is a practical safeguard: it keeps the developer in the decision loop and avoids blindly adopting AI-generated code that may not fit the project's actual database driver or error codes.
The diff-based approach solves a real failure mode of AI code review — models that re-analyze unchanged code and drown the developer in noise — by constraining attention to the exact lines that changed.
The triage buckets (high/medium/low) mirror what senior reviewers do instinctively; making them explicit gives junior developers a rubric for deciding which AI findings actually block a commit.