Review of AI-generated code
Code written with Copilot, Cursor, Claude or ChatGPT often works in the demo and fails in production. I review it the way I would review any pull request, before it reaches your live site, whether your team uses AI assistants every day or a whole build was generated with them.
engagement: One-off review or ongoing PR review covers: Drupal, Symfony, custom PHP access: Read-only repository access output: Written report with prioritised fixes
Sounds familiar?
- Your team ships AI-written code faster than anyone can review it
- A supplier delivered code you suspect was generated and not checked
- A prototype built with AI tools is about to go into production
- There's no senior PHP developer in-house to review pull requests
The work, in detail.
Security: injection, access checks, secrets
SQL injection, cross-site scripting, missing permission checks and credentials committed to the repository.
Correct use of Drupal and Symfony APIs
Code that bypasses entity access, writes raw queries instead of using the database API, or ignores dependency injection and cache metadata.
Performance and caching problems
Queries in loops, uncached expensive work, and caching that serves one user's data to another.
Invented functions and packages
Hooks, methods and services that don't exist, and package names that look right but aren't the real library.
Missing tests and edge cases
Empty values, permissions, failures and the unhappy paths generated code tends to skip.
Written report with prioritised fixes
Every finding explained, rated by severity, with the fix described or written.
From first call to finished work.
Every engagement starts with a free 30-minute discovery call and a written proposal. Nothing starts until the scope, price and terms are agreed in writing.
Share access
Read-only access to the repository, or a link to the pull requests you want reviewed.
Review
The code is read and run, not just scanned, against the same standard as any senior review.
Report
Findings ordered by severity, with inline comments on the pull request where that helps.
Fix or guide
I fix the issues, or your team does from the notes, followed by a quick re-review.
Frequently asked.
Are you against AI coding tools?
No. They speed up a lot of work. The risk is unreviewed output. A review catches the mistakes these tools tend to make before they reach production.
How do ongoing pull request reviews work?
I'm added as a reviewer on your repository and review pull requests within an agreed time, as part of a monthly plan.
Do you need access to our live site?
No. Read access to the repository is enough for most reviews. If I need to run the code, a local or staging copy is used.
Can you review code that isn't Drupal or Symfony?
Yes, if it's PHP. The review covers framework-specific issues where they apply and general PHP quality everywhere.
Tell me what your site needs.
The first conversation is free and comes with no obligation. Tell me about your site and I'll come back with a written proposal.