All posts

Code review people don't dread

Published June 6, 2026 · by Majd Ghithan, written with the help of AI

Code review people don't dread

I once left forty-one comments on a junior's pull request. I was proud of it. Thorough, I told myself. The next day he barely made eye contact, and his next PR sat open for a week because he was terrified to hand it to me again. I had reviewed the code perfectly and broken the person.

That's the thing nobody tells you about review: the code is the easy part. The hard part is that a review is a message from you to another human, and they read the tone before they read the logic.

Here's how I do it now.

Separate the nit from the blocker

Most of what I want to say on a PR doesn't actually block the merge. A variable name I'd have picked differently, a helper that could be extracted later, a test I'd have written slightly cleaner. Real, but not worth holding the branch hostage over.

So I label. If a comment starts with nit:, it means "take it or leave it, I won't re-request changes over this." If it doesn't have a prefix, it's a real blocker and I say why it blocks. That one convention changed my reviews more than anything else. The author instantly knows what they have to deal with versus what's just my taste.

Tone is not a soft skill, it's the whole message

A review comment has two jobs: fix the code, and keep the person willing to write more code. You can nail the first and fail the second, and then it doesn't matter how right you were.

The difference is usually one small rewrite. "Change this" is an order handed down. "Here's why" is two engineers looking at the same problem. Same fix, completely different thing to receive.

Comment they resent
This is wrong. Don't query inside the loop.
Comment they learn from
This runs a query per iteration - it'll be an N+1 once orders grows. Eager-load with with('customer') above the loop and it drops to one query. Same bug bit me last quarter.

The right-hand one is longer, and it's worth every character. It names the problem, explains the why, hands over the fix, and quietly says "I've made this mistake too." Nobody feels stupid reading that. They feel like they just got let in on something.

"Here's why" beats "change this" every time

If I can't explain why a change matters, maybe it doesn't. Forcing myself to write the reason is also a filter on my own comments. Half the time I start typing "you should…", hit the "because…" part, and realize my reason is just "it's how I'd do it." That comment doesn't get posted.

When the reason is real, the author gets a lesson they carry to the next PR. When it isn't, I've saved us both a pointless thread. Either way, writing the why makes the review shorter over time, because people stop repeating the mistakes you actually explained.

Async review is a feature, not a downgrade

I don't need to sit next to someone to review their code, and honestly I review better when I don't. Async means the author isn't watching my face while I read, so they're not defending in real time, and I'm not performing thoroughness. They get my comments, they sit with them, they push back on the ones I got wrong.

The rule that makes async work: a review is a conversation with a clear end. I don't leave forty-one open threads. I leave the blockers, a couple of nit:s, and one line at the top that says the verdict, "two real things to fix, rest is optional, ping me when it's ready." The author knows exactly what "done" looks like.

The approval is part of the review too

I used to only speak up when something was wrong, which trained everyone to read my name in the reviewer list as bad news. Now if someone solved a gnarly problem cleanly, I say so, right there on the line. It costs me five seconds and it buys something real: the next time I leave a blocker, they know I'm not just hunting for faults. I'm reading the whole thing, the good parts included.

The point

A review isn't a gate you stand at to keep bad code out. It's the main way your team learns from each other, and the main way trust either builds or erodes, one comment at a time.

Get the code right, sure. But the code was always going to get fixed. What you're actually deciding, every time you hit "submit review," is whether the person on the other end walks away sharper and still wanting to write code, or quietly starts routing their PRs to literally anyone but you.

🤖 Heads up: this post was drafted with AI. Spot something wrong or off?Edit it on GitHub & open a PR
Majd Ghithan

Majd Ghithan

Full-Stack Engineer & Tech Lead

More posts

Laravel finally resizes images for you

Laravel finally resizes images for you

Every Laravel app I've built that takes an avatar ended the same way: composer require intervention/image, wire up a facade, write a little service class, and hope the next dev…

July 26, 2026Read more
What actually breaks at 100,000 users (that never breaks in a demo)

What actually breaks at 100,000 users (that never breaks in a demo)

The first time I shipped a dashboard to a hundred thousand active users, nothing I had tested was what broke. Everything that failed had passed every check I ran. It worked on m…

July 25, 2026Read more
Where your queue jobs go to die under load

Where your queue jobs go to die under load

The support ticket said "I never got my invoice email." I checked the logs. The job ran. It succeeded. failedjobs was empty. Everything said the email went out. It did not.

July 18, 2026Read more
The indexes you're missing (and the one that's hurting you)

The indexes you're missing (and the one that's hurting you)

A client sent me a query that took 4.2 seconds. One WHERE, one ORDER BY, a table with three million rows. I added a single index and it dropped to 11 milliseconds. They asked if…

July 11, 2026Read more
Caching in Laravel without the stampede

Caching in Laravel without the stampede

We cached the homepage's "trending products" query for five minutes. It was our slowest query — about 900ms, a big aggregation across orders. Caching it took the homepage from s…

July 4, 2026Read more
Taking one endpoint from 800ms to 80ms

Taking one endpoint from 800ms to 80ms

The order-details endpoint took 800 milliseconds. Not broken, just slow enough that the app felt heavy everywhere it was used. The team's instinct was "the server needs more mem…

June 27, 2026Read more
The N+1 you can't see (it's hiding in your accessors)

The N+1 you can't see (it's hiding in your accessors)

I've fixed hundreds of N+1 queries. The easy ones are right there in the controller — a foreach with $order-customer inside it, obvious the moment you read the code. Those aren'…

June 20, 2026Read more
The Friday deploy that charged customers twice

The Friday deploy that charged customers twice

It was 4:40 on a Friday. The change was tiny — a one-line tweak to how we called the payment provider, plus a bump to the queue worker's timeout. Small, tested, reviewed. I depl…

June 13, 2026Read more
Hiring a mid-level Laravel dev: the signals that actually matter

Hiring a mid-level Laravel dev: the signals that actually matter

The best hire I ever made failed my first question. I asked him to explain service containers and he stumbled, went quiet, then said "honestly I use them every day but I've neve…

May 30, 2026Read more
Saying no to a feature without being the 'no' person

Saying no to a feature without being the 'no' person

For about a year I was the engineer everyone learned to route around. Not because I was wrong, I was usually right, but because my answer to new ideas was a flat "no, that'll br…

May 23, 2026Read more
My first 90 days as a tech lead (and the habit I had to break)

My first 90 days as a tech lead (and the habit I had to break)

Three weeks into leading my first team, I stayed late to "help" by rewriting a junior's feature myself. It was faster my way. I pushed it, felt productive, went home. The next m…

May 16, 2026Read more
Breaking down the task that scares you

Breaking down the task that scares you

There's a specific kind of ticket that makes my stomach drop. Not the hard ones, hard is fine. It's the ambiguous ones. "Migrate billing to the new provider." "Add multi-tenancy…

May 9, 2026Read more
1:1s that aren't just status updates

1:1s that aren't just status updates

For my first few months as a lead, my 1:1s were thirty minutes of me asking "so, what are you working on?" and nodding at answers I already knew from standup. We both left sligh…

May 2, 2026Read more
Get the business logic out of your controllers

Get the business logic out of your controllers

I once opened a OrderController@store method that was 240 lines long. Validation, a discount calculation, three model writes, a Stripe charge, two emails, a Slack notification,…

April 25, 2026Read more
Form Requests are the most underrated thing in Laravel

Form Requests are the most underrated thing in Laravel

Most Laravel devs meet Form Requests once, in a tutorial, use them to hold a rules() array, and never look deeper. That's a shame, because a Form Request is the cleanest place i…

April 18, 2026Read more
Testing Laravel without mocking everything

Testing Laravel without mocking everything

I inherited a codebase once with 900 unit tests and no confidence. Every test mocked the repository, mocked the model, mocked the mailer, mocked the thing three layers down. The…

April 11, 2026Read more
Three Eloquent features that clean up your models

Three Eloquent features that clean up your models

The messiest Laravel model I ever wrote wasn't messy because of Eloquent. It was messy because I ignored the parts of Eloquent that exist specifically to keep it clean. The same…

April 4, 2026Read more
The migration that locked the table for eight minutes

The migration that locked the table for eight minutes

The deploy looked boring. One migration, adding a lastseenat column to the users table with a default of now(). I'd written a hundred like it. I ran it at 2pm on a Tuesday becau…

March 28, 2026Read more
Chasing a memory leak in a Laravel queue worker

Chasing a memory leak in a Laravel queue worker

The alert came in at 4am: one of our queue:work processes had been OOM-killed. The supervisor restarted it, it processed jobs for about forty minutes, and got killed again. It w…

March 21, 2026Read more