We're a small team and our reviews are thorough in spirit and rushed in practice, because everyone reviewing is also shipping their own thing. A 300-line diff for a new admin search endpoint had sat in review for two days and quietly collected three approvals. It was Friday afternoon, I was the person hitting the merge button, and right before I did, on a genuine whim, I ran it through the Review a PR Diff for Real Bugs and Security Holes (Skip the Nits) prompt. I am very glad whims are free, because that whim is the reason we did not spend the weekend writing an incident report.
What it surfaced
I set language_and_framework to 'Python / FastAPI + SQLAlchemy' and pr_intent to 'add an admin search endpoint with filters.' Gemini 3 Pro Preview returned a clean Markdown table of six findings, sorted by severity. Five were the usual MEDIUM/LOW texture you'd expect — a possible N+1 on a relationship load, an over-broad `except Exception` swallowing errors, no rate limit on the endpoint. Useful, not urgent. The top row was CRITICAL, and it stopped my Friday cold: a raw f-string interpolating a request-body `search_term` straight into a SQLAlchemy `text()` call. Textbook SQL injection, sitting in plain sight on line 47, in an endpoint every one of us had mentally filed under 'admin only, low risk, who cares.'
The 'Why it matters' cell didn't mince words: an authenticated admin-panel user — or anyone who phished an admin session — could read or drop arbitrary tables. The suggested-fix cell handed me the parameterized version. Total time from paste to 'oh no': about ten seconds.
Why three of us missed it
I want to be clear I'm not throwing my teammates under the bus, because I approved it too and I'm the one who almost merged it. Code review fatigue is a real, measurable, well-documented thing, and a 300-line diff is parked right at the edge of where human attention reliably gives out. The interesting part is how predictable the failure was in hindsight.
- Line 47 of 300 is deep in the fatigue zone — by then everyone's eyes are doing the 'looks plausible, scroll' thing rather than actually parsing each statement
- The phrase 'admin only' made every reviewer unconsciously downgrade the threat, even though admin panels are exactly where injection hurts most because they have the most powerful queries
- The variable was named `search_term`, which reads as a benign search term, not as the attacker-controlled string it actually was — naming hid the danger
- The dangerous line looked almost identical to a safe parameterized call three lines above it, so the eye pattern-matched it as 'same as the good one'
Why Gemini for this, and why it's the one I charge for
This is the single prompt in my coding set I marked premium, and I stand by every cent. Long diffs are precisely where Gemini 3 Pro Preview's long-context strength earns its keep — it holds the entire 300 lines in working memory and connects a tainted source on line 47 to a SQL sink twelve lines down without losing the thread, the exact connection a tired human drops. The table output keeps it ruthlessly concrete instead of essayistic: severity, exact file-and-line location, one-sentence real-world impact, and a concrete fix per row. And the prompt's hard rule that it must rank injection, missing auth checks, and unvalidated input as at least HIGH means the scary stuff floats to the top of the table where I'll actually see it before the N+1 noise.
The other half of why I trust it is the 'never invent findings to look thorough' rule. When it tells me a section is clean, I believe it, because it isn't padding the table to seem useful. A reviewer that cries wolf is worse than no reviewer; this one stays quiet when it should.
We blocked the merge, swapped in a parameterized query, added a test, and the prompt now runs as a pre-merge step in CI. It is emphatically not a replacement for human review — it misses product-context judgment, it can't know our threat model, and it would happily approve a feature that shouldn't exist. But it is a second pair of eyes that is never tired at line 47 on a Friday. Grab the Review a PR Diff for Real Bugs and Security Holes (Skip the Nits) prompt on Prompt Dock and run it on the next big diff you're one click away from rubber-stamping — and turn every CRITICAL it finds into a permanent regression guard with my Write a Failing Test That Reproduces This Bug Before I Fix It prompt.