ChatGPT can review code and find useful bugs. It works best on a small change with a clear description, the relevant surrounding code and a focused question.
It is a manual review. You choose what to send, collect the right context and check every claim. That makes it useful for a second opinion or a local change. It becomes awkward as a standard review process across many repositories.
Check the data rules first
Source code can contain customer logic, internal URLs, credentials, personal data and security controls. Do not paste it into a personal AI account until your organization allows that data path.
OpenAI says users of personal ChatGPT plans can turn off “Improve the model for everyone” in Data Controls. New conversations are then excluded from model training. Temporary Chats do not appear in history and are not used for training, although OpenAI may keep a copy for up to 30 days for safety.
OpenAI also says it does not train on inputs or outputs from ChatGPT Business, ChatGPT Enterprise or the API by default.
Those settings answer one part of the privacy review. Your team must still check retention, access, approved accounts, regional needs and whether the code can leave your environment. Remove secrets even when the service is approved.
For a wider look at model accounts and source-code privacy, read the BYOK AI code review guide.
Prepare the change
Give ChatGPT a reviewable unit. A good input contains:
- The intended behavior
- The changed code or diff
- Relevant types, callers and tests
- Repository rules that affect the change
- The checks that already passed
Do not send the whole repository without a plan. More code can hide the useful part and make the answer less focused.
Start with the diff, then add the files that define its contracts. If a function changes a database query, include the schema and a nearby safe query. If an API response changes, include the public type and one caller.
Use a focused review prompt
Copy this prompt and replace the bracketed parts:
Review this change for correctness and security.
Intended behavior:
[Describe what must happen and what must never happen.]
Repository rules:
[List specific rules that apply.]
Checks already run:
[Tests, typecheck, lint and other checks.]
Changed code:
[Paste the diff or changed functions.]
Relevant context:
[Paste types, callers, schema and tests needed to judge the change.]
For each finding:
1. Name the failure.
2. Point to the code that causes it.
3. Explain which fact in the supplied context supports the claim.
4. Give a test that fails before the fix and passes after it.
Do not report style preferences, naming issues or claims that the supplied code cannot support. If context is missing, ask for the exact file or fact you need.This prompt gives the model a job and a standard for evidence. It does not make the answer correct. You still need to check the result.
Review in passes
One broad request can mix serious defects with weak suggestions. Separate the work when the change is risky.
First pass: behavior
Ask whether the code implements the stated behavior. Check conditions, data flow, error paths and state changes.
Second pass: security
Ask about authorization, input handling, secrets, dependency changes and dangerous defaults. Include the repository's real access rules. “Check security” without those rules produces generic advice.
The AI-generated code security checklist has concrete questions for this pass.
Third pass: tests
Ask which failure cases have no test. Then inspect the proposed tests. A test that repeats the implementation's assumption proves little.
Fourth pass: change impact
Ask which callers, jobs, schemas or deployments may depend on the changed contract. Provide those files when the model asks for them.
Check every finding
For each comment, find the line and follow the failure through the code yourself.
Reject the finding when:
- it assumes a fact that is not in the code
- it ignores a guard in a caller
- it invents library behavior
- it reports a style choice as a bug
- the proposed failure cannot happen
- the fix breaks the intended behavior
When a finding looks real, write or run the smallest test that proves it. Remove the proposed fix and confirm that the test fails. Then restore the fix and run the wider relevant test set.
ChatGPT can sound certain when the prompt lacks the deciding file. Ask it to name the missing evidence instead of guessing. The same missing context causes many AI code review false positives.
What ChatGPT does well
Manual ChatGPT review works well for:
- a small function or patch
- explaining a suspicious code path
- listing failure cases before you write tests
- checking a change against a rule you provide
- getting a second view on a difficult review comment
- reviewing local code before a pull request exists
It is also useful when you want a conversation. You can add a caller, correct an assumption and ask the model to test the claim again.
Where it breaks down
Manual review becomes slow when the code spans many files. You must collect context, keep the prompt current and move findings back into GitHub. The next pull request starts the process again.
It also lacks the controls a team usually wants:
- automatic review on every pull request
- repository and path filters
- saved team rules
- stable links to files and lines
- review history by repository
- usage and quality measures
- a clear response to new pushes
A repository-aware pull request reviewer handles that repeated work. The reviewer still needs human checks, but it can gather context and put each finding where the author will see it.
When to move to an automated reviewer
Keep manual ChatGPT review when one person needs an occasional second opinion. Test an automated reviewer when several people repeat the same copy-and-paste process or when reviews depend on files outside the diff.
Use the GitHub AI code review workflow to define the process first. Then compare tools on real pull requests. Scopy is an open-source option that gathers repository context, checks library documentation and verifies findings before it posts them. The quickstart shows the hosted setup.
ChatGPT can help you review the next small change today. Keep the prompt narrow, protect the code and prove each finding with the repository and tests.