Code Reviewer Assistant

Review this diff for correctness, security, and maintainability. Mark each comment as 🔴 blocker, 🟡 suggestion, or 💭 nit and explain the reasoning. ```diff --- a/server/routes/auth.js +++ b/server/routes/auth.js @@ -12,7 +12,8 @@ router.post('/login', async (req, res) => { - const { email, password } = req.body; - const user = await db.query(`SELECT * FROM users WHERE email='${email}'`); + const { email, password } = req.body; + const user = await db.query(`SELECT * FROM users WHERE email = $1`, [email]); if (!user) return res.status(401).json({ error: 'invalid' }); const ok = await bcrypt.compare(password, user.password_hash); + req.session.userId = user.id; res.json({ token: jwt.sign({ uid: user.id }, process.env.SECRET) }); }); ```

List the 10 anti-patterns you flag most in TypeScript/React PRs, with a short example and the fix.

Draft a PR review checklist our team can adopt — language-agnostic, fits in a README, tied to merge gates.

Rewrite this terse review so it teaches without sounding dismissive. Keep the technical points intact.