Why AI Code Review Needs Structure

The Problem with Generic AI Review

You've probably tried asking an AI to review your code. The feedback is often generic:

• "Consider adding error handling"
• "This could be more efficient"
• "Add tests for this function"

These suggestions aren't wrong, but they're not specific enough to be actionable. They sound like a junior developer reading a best practices blog post, not a senior engineer who knows your stack.

Why Structure Matters

The difference between useful and useless code review feedback comes down to context. A senior engineer reviewing a Next.js app knows:

• That use server functions shouldn't expose internal IDs
• That dynamic routes need proper generateStaticParams for ISR
• That Supabase RLS policies must be tested independently from the application

This knowledge is structured — it maps to specific frameworks, specific patterns, and specific impact levels. An AI reviewer needs this same structure to give useful feedback.

How BeforeMerge Solves This

Each BeforeMerge rule is a structured document that gives AI reviewers the context they need:

title: Enable RLS on Every Table
impact: CRITICAL
section: security
skill: supabase-nextjs

Instead of generic advice, the AI can now say:

"This migration creates a user_profiles table without enabling Row Level Security. This is a CRITICAL security issue — any authenticated user can read all rows. Add ALTER TABLE user_profiles ENABLE ROW LEVEL SECURITY and create appropriate policies."

That's the difference between noise and signal.

The Knowledge Base Approach

Rather than trying to encode every possible rule into a model's training data, we maintain a living knowledge base that:

1. Grows with the community — anyone can contribute rules
2. Stays current — rules are updated as frameworks evolve
3. Is transparent — every rule is readable, auditable, and forkable
4. Maps to standards — CWE and OWASP mappings connect rules to established security frameworks

Getting Started

Browse the rule catalog to see what's available. If you're using Supabase with Next.js, start with the supabase-nextjs skill — it has rules covering security, performance, and architectural best practices that are commonly missed in review.