---
name: cpp-code-review
description: >-
  Review C++ (and C interop) code and PRs for undefined behavior, memory/
  lifetime bugs, concurrency, error handling and modern idioms. Use whenever
  reviewing or auditing C++ code.
---

# C++ Code Review

Review C++ changes for real bugs first, style last. Be concise and cite
file:line.

## Workflow

1. **Scope**: identify what changed (diff, PR, or files). Check the build files
   (`CMakeLists.txt`, etc.) for the C++ standard (`-std=`/ `CMAKE_CXX_STANDARD`)
   and compiler. Don't suggest features newer than the project's standard.
2. **Tooling**: if you can run commands, run what's available and fold results
   in (don't re-report what they catch):
   - Build with `-Wall -Wextra -Wpedantic` (or `/W4` on MSVC)
   - `clang-tidy` (with `bugprone-*`, `cppcoreguidelines-*`, `modernize-*`)
   - Tests under sanitizers: `-fsanitize=address,undefined`; separately
     `-fsanitize=thread` for threaded code
3. **Review by priority**: read only the reference files that apply:

| Change touches                                                                  | Read                               |
| ------------------------------------------------------------------------------- | ---------------------------------- |
| Raw pointers, `new`/`delete`, buffers, casts, C APIs, references to temporaries | `references/memory-ub.md`          |
| Threads, atomics, mutexes, `std::async`, coroutines                             | `references/concurrency.md`        |
| Exceptions, error codes, classes, templates, API design, integer types          | `references/correctness-idioms.md` |
| Naming, signatures, includes, class layout, conventions                         | `references/project-style.md`      |
| Unsure whether a finding is real                                                | `references/false-positives.md`    |
| Need to explain or verify a language/library rule                               | `references/cppreference.md`       |

4. **Report**: use `references/report-template.md`.

## Priorities (in order)

1. Undefined behavior and memory safety (overflow, use-after-free, dangling,
   out-of-bounds)
2. Security (untrusted input reaching buffers, format strings, integer
   conversions)
3. Concurrency bugs (data races, deadlocks)
4. Resource leaks and exception safety
5. API/correctness and performance (copies, allocations)
6. Modern idioms and readability

## Rules

- Only flag issues you can explain concretely. No speculation.
- Don't comment on formatting (whitespace, line breaks); that is
  `clang-format`'s job. Do enforce the project's coding conventions; see
  `references/project-style.md`.
- Suggest a fix with a short code snippet when possible.
- Before asserting a language or library rule (e.g. iterator invalidation, UB,
  which header declares a type), verify it on cppreference. Link the page in the
  finding instead of writing a long explanation. See
  `references/cppreference.md` for how to look things up.