Code Review Interview Questions and Exercises

Code review exercises provide immediate signal on how candidates inspect code for bugs, edge cases, and architectural flaws. Here are realistic code review interview scenarios with guidance for interviewers.

Scenario 1: Database N+1 Query Anti-Pattern

// Flawed Pull Request:
async function getUsersWithOrders(userIds) {
  const users = [];
  for (const id of userIds) {
    const user = await db.query('SELECT * FROM users WHERE id = $1', [id]);
    const orders = await db.query('SELECT * FROM orders WHERE user_id = $1', [id]);
    users.push({ ...user, orders });
  }
  return users;
}

• •What to look for: Candidate identifies N+1 database roundtrips and refactors using SQL IN (...) clauses or batch JOIN queries.
• •*Practice N+1 Queries on Pairlet.*

Scenario 2: Swallowed Async Exceptions

// Flawed Pull Request:
async function processPayment(payment) {
  try {
    await stripe.charges.create(payment);
    await auditLogger.log(payment.id);
  } catch (err) {
    console.log("Something went wrong");
    return true; // Returns success despite failure!
  }
}

• •What to look for: Candidate catches the silent error swallowing and false positive return value.
• •*Practice Async Error Handling on Pairlet.*

Scenario 3: Node.js Memory Leak via Global Listeners

• •*Practice Node.js Memory Leak on Pairlet.*

Scenario 4: Authorization Bypass in a Document API

Ask the candidate to review a document-sharing endpoint that checks whether a document exists but does not verify that the current user may access it.

• •What to look for: The candidate distinguishes resource existence from resource ownership and explains the risk of an insecure direct object reference.
• •What to ask next: “Where should authorization live, and what would you log without exposing sensitive data?”
• •*Practice Authorization & Security Bug on Pairlet.*

Scenario 5: Unrestricted Concurrency in a Batch Job

Give the candidate a dispatcher that starts thousands of requests with an unbounded concurrency level.

• •What to look for: The candidate identifies resource exhaustion, rate limits, back-pressure, and the need for a deliberate failure policy.
• •What to ask next: “What is the smallest safe change that preserves the business requirement?”
• •*Practice Promise Concurrency Exhaustion on Pairlet.*

How to Score the Review

Use the same rubric for every candidate:

1. Correctness: Does the candidate identify behavior that can fail or lose data?
2. Risk prioritization: Do they separate blockers from suggestions and explain the impact?
3. Design judgment: Can they propose a focused change without over-engineering it?
4. Communication: Do they ask clarifying questions and give actionable feedback?

A candidate does not need to find every planted flaw to show strong signal. A clear, well-reasoned prioritization is more useful than a long list of guesses.

Interviewer Prompt Sequence

1. “What is this change supposed to accomplish?”
2. “What would you verify before editing anything?”
3. “Which finding has the highest impact?”
4. “What is the smallest safe fix?”
5. “How would you test that the fix works?”
6. “What would you automate for the next review?”