# JavaScript + Node.js Code Review

Review {{input}} for code quality, correctness, and best practices.

## JavaScript
- Use `const` by default; `let` only when reassignment is needed; never `var`
- Add JSDoc types on public functions and complex objects for editor support
- Prefer explicit `===` over `==`; avoid implicit type coercions
- Destructure objects/arrays where it improves clarity

## Node.js / Async
- No unhandled promise rejections or floating promises
- Errors must be caught and handled or propagated — never silently swallowed
- Validate all environment variables at startup (not at use-time)
- Clean up resources on exit: file handles, DB connections, event listeners, timers, streams

## Reliability
- Handle edge cases: null/undefined inputs, empty arrays, zero, NaN, Infinity
- Idempotency for retryable operations (DB writes, external API calls)
- Graceful shutdown: handle SIGTERM/SIGINT, drain in-flight requests before exiting

## Security
- No secrets, tokens, or PII in logs or error messages
- Validate and sanitise all external inputs before use
- Avoid `eval`, `new Function()`, dynamic `require()` with user-controlled values
- Parameterise all DB queries — no string interpolation in SQL or query filters
- Never return stack traces to API callers

## Code Quality
- Each function should do one thing; aim for < 30 lines
- `camelCase` for variables/functions; `PascalCase` for classes
- No dead code, commented-out blocks, or unresolved TODOs
- Tests cover the happy path and key failure modes

---
List findings as **Critical** (security/data loss/crashes) -> **Major** (bugs/wrong behaviour) -> **Minor** (style/improvements). Cite each location and suggest the concrete fix.