To start things off: I always run the app myself on the main flows and read the code for anything touching data or payments. AI code often looks right but misses edge cases.

Beyond tests, I diff the AI output against what I actually asked for, because it loves to "helpfully" change things outside the scope. I also scan for hardcoded secrets, swallowed errors (empty catch blocks), and any new dependencies it pulled in. And +1 on edge cases: asking it to list the edge cases it didn't handle surfaces a surprising amount.

Good call on diffing against what I actually asked for. I've seen AI quietly rewrite things I never mentioned. Asking it to list the edge cases it skipped is a great trick, I'm adding that to my checklist.

I like adding a scope diff and a quick secrets, error-handling, and dependency scan to the checklist. Asking the model to call out skipped edge cases is a useful prompt too.

One more for that checklist: I paste the diff back into a fresh chat and ask it to review the code as if someone else wrote it. It's surprisingly good at catching its own mistakes when it doesn't know they're its own.

That fresh-chat review is a practical way to reduce confirmation bias; I also like checking the changed files against the original task before merging. Do you have a standard prompt for that review?