Reviewing your own code is hard because you read what you meant rather than what you wrote. A model doesn't have that problem — but "review this code" produces a generic list of style opinions, so the framing does the work.

Ask for specific categories

A focused review finds real things. A general one finds naming preferences.

focused-review.txt
Review this code for ONE thing: what breaks with unexpected input.

<paste>

For each function, tell me what happens with: empty, null, the wrong
type, a much larger value than expected, and deliberately hostile
input.

Only report things that actually break or behave wrongly. Don't
comment on style, naming or structure — I'll ask separately.

Run it again for security, again for performance, again for readability. Four focused passes beat one general one by a wide margin.

Make it argue with itself

Models are agreeable, and will find problems because you asked for problems. Add a verification step:

verify-findings.txt
You listed these issues: <paste them back>

For each, argue the opposite case: why might this NOT be a problem in
my situation?

Then give me a final verdict on each: definitely fix, worth
considering, or not actually an issue. Be willing to say your own
finding was wrong.

This removes a surprising proportion of findings, and the ones that survive are worth acting on.

The reviews that find the most

"What would surprise a new maintainer?" — finds things doing something other than their name suggests.

"Which routes return data without checking it belongs to the requester?" — finds the most common real security flaw in small apps.

"What's not handled?" — errors swallowed, cases ignored, paths with no code.

"What's duplicated?" — the characteristic shape of code assembled across many conversations.

Then read it yourself

A model review is a list of candidates, not a verdict. It'll miss things it can't see — anything depending on files you didn't paste, or on how the system is actually used. Use it to direct your attention, not to replace it.

Review before you commit, not after. A finding you act on immediately is worth several you file and forget.