# Review rules for an app built with AI

These rules point the reviewer at what AI coding agents most often miss.
Edit them to match your app. Plain sentences work best.

## First run
- Every screen must work for a brand-new user with no data. Flag any code that assumes a project, profile, subscription or list item already exists.

## Auth and permissions
- Every new page and API route must check that the user is logged in and allowed to access the data it returns. Flag any route that reads user data without checking ownership.
- Pages behind a login must redirect logged-out visitors instead of rendering an empty or broken page.

## Loading, empty and error states
- Every network request needs a loading state and a visible error message. Flag requests whose failure is ignored or only logged to the console.
- Lists and tables need an empty state that tells the user what to do next.

## Production-only config
- Flag every new environment variable, secret, webhook, cron job or database migration so it can be set up on the live server before merging.
- Database migrations must not drop or rename columns that hold existing user data without a backfill.

## Shared code
- When a shared component, hook, helper or style changes, list the other screens that use it and check they still behave the same.

## Mobile
- Flag fixed widths, hover-only interactions and buttons that can be pushed off screen on a 375px wide phone.

## Leftovers
- No API keys, secrets or tokens in code. No console.log of user data. No test accounts or hard-coded user IDs.