I Seeded 5 Hidden Bugs to Test Claude Code Review—It Caught All 5 and Uncovered a Real Mistake

Bug Insertion

A separate git worktree was created for a 1,100‑line main.py. Thirteen lines of diff introduced five hidden bugs covering security, caching, arithmetic, aggregation, and string handling—types that are often missed in manual reviews.

Bug count inserted: 5 (security / cache / arithmetic / aggregation / string)

Detected: 5/5, all CONFIRMED

Unexpected find: 1 real bug submitted days earlier

Time taken: 29 min 26 s (high‑effort mode)

Internal concurrency: 17 subagents

Detection Results and Impact Analysis

Security bug (JWT expiration disabled) : verify_jwt_token called with options={"verify_exp": False} disables JWT expiration. Any leaked cookie grants permanent admin rights; the only revocation method is rotating the JWT secret.

main.py:514 : verify_jwt_token called with options={"verify_exp": False} . No later code validates exp , turning an 8‑hour session into a permanent one. Only revocation: rotate JWT secret . [CONFIRMED]

Aggregation bug (percentage calculation) : Integer division order a * 100 // b was used, yielding 0 for total=100, usage=30 instead of 70. Two adjacent progress bars displayed contradictory states.

total=100, usage=30 → remaining=70 → 70 // 100 * 100 = 0 , showing 0% instead of 70% ; the front‑end regex parsing caused one bar to be zero width while the other remained correct. [CONFIRMED]

Cache bug : A timestamp cache was refreshed without updating the stored value, effectively making the cache permanently stale.

String handling bug : token[-4:] was mistakenly changed to token[:4], a classic copy‑paste error that masks the token incorrectly.

Arithmetic bug : min(...) was changed to max(...) without updating the variable name min_resets_ms or comments, leaving the code misleading.

Logout bug (not among the seeded bugs) : The httponly flag prevented JavaScript from deleting the session cookie, the cookie path mismatched the original set path, and the front‑end never called the server‑side logout endpoint, resulting in a permanently valid session.

Review Pipeline Details

Running /code-review creates a session log under ~/.claude/projects/. The pipeline spawns 17 subagents that operate in four phases:

Phase 0: Ten parallel search perspectives (line‑by‑line scan, delete‑audit, cross‑file trace, Python traps, wrapper correctness) plus four cleanup dimensions and a CLAUDE.md spec check.

Phase 1: De‑duplication merges the ten perspectives into five candidate issues.

Phase 2: Each candidate is verified by a dedicated agent; only when all five return CONFIRMED does the issue appear in the report. False positives are filtered (e.g., a max() call on an empty list was guarded by a prior if not models check).

Phase 3: A final sweep catches any remaining problems, such as the logout bug.

Speeding Up the Review

Two ways to reduce the 29‑minute runtime:

Lower the effort level: /code-review low runs faster with fewer results; /code-review high provides broader coverage.

Run the review as a background subagent (available from v2.1.218) using /fork, allowing the main conversation to continue while the report is generated.

For CI integration, the command can be scripted:

# CI or script execution
claude -p "/code-review" --permission-mode bypassPermissions

Command Reference Cheat Sheet

/code-review

– Review current branch changes and uncommitted edits. /code-review low – Set effort from low to max; default is the current session level. /code-review main...feature – Diff between two branches (equivalent to a PR diff). /code-review 1234 – Review a GitHub PR by number. /code-review --fix – Apply confirmed fixes directly to the workspace. /code-review --comment – Post findings as inline PR comments. /review <pr> – Fast single‑pass review, speed‑first. /simplify – Perform code cleanup and apply changes without bug detection.

Historical Command Changes

Before v2.1.147 the only command was /simplify, which both found bugs and cleaned code. From v2.1.147 it was renamed to /code-review with --fix required to apply changes. v2.1.154 re‑introduced /simplify for cleanup‑only tasks.

Conclusion

The experiment shows that Claude Code does not merely glance at a diff; it runs a structured pipeline—find bugs, verify them, and scan for leftovers—providing reproducible paths and consequences for each issue. A 13‑line diff yielded six confirmed problems, including an old unnoticed bug, demonstrating the value of running the tool on small diffs with low‑effort mode before larger merges.

Related Links

Code Review documentation: https://code.claude.com/docs/en/code-review

Claude Code weekly updates: https://code.claude.com/docs/en/whats-new

Full changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md