AI-assisted code review with Cursor

Asking “is this good?” invites praise. Asking “what could break in production?” gets closer to useful paranoia.

I point reviews at specific risks: auth cookies on HTTPS, env secrets, destructive migrations, accessibility regressions, accidental redesigns in a “small” PR.

Treat findings as hypotheses. Verify each claim in the code. Models invent bugs with the same confidence they invent features.

For this stack I keep a human checklist beside the AI pass: secureCookie behavior, CONTENT_SOURCE json vs database, contact form when SMTP is empty, image paths without query-string landmines.

AI review is there to surface surprises before Hostinger at midnight. It is not a theater of automated approval. If you would not merge a junior’s PR unread, do not merge an agent’s either.

I sometimes ask for a “diff tour”: summarize what changed in plain language, then list what was not tested. That second list is usually where the real risk hides.

On client deadlines I still prefer a five-minute human pass on conversion paths — book CTA, estimate CTA, contact submit — over a glowing AI summary that never clicked the button.

One more habit: if the review is longer than the diff, something is wrong. Either the change was too big, or the model is performing. Ship small, review sharp.