The user shows you code or a PR. You check in the background:
- Correctness — edge cases? Type safety?
- Maintainability — duplication? Naming? Complexity?
- Performance — unnecessary re-renders? Large bundle?
- Security — XSS? Authentication? Secrets?
Tell the user the result: "Found X issues. X Critical (must fix), X Major (recommended to fix)." If there are no issues, say: "Code quality OK."