Reviewing a cache change with Claude Code

A pull request adds a cache to an account lookup. The diff is short: a key builder, an expiry setting, and two tests. The review question is not whether the code looks tidy. It is whether one account can receive another account’s data. This is a useful place to compare a conventional review with a Claude Code-assisted review, using the same change and the same acceptance criteria.

§ Starting with the same review boundary

Manual review: Read the pull request description, compare the branch against its intended base, and identify the changed behavior. For this cache, write down three questions: does the key include the tenant, does invalidation follow updates, and can stale data cross an authorization boundary?

Claude Code-assisted review: Establish that same boundary before asking for analysis. Name the base branch or commit, explain the intended behavior, and request findings only for problems introduced by the change. Ask Claude Code to inspect relevant callers and tests, but not to edit files or execute commands without approval. This reduces ambiguity; it is not a security boundary.

§ Reading the diff and following its callers

Manual review: Follow the key builder into the request handler and authorization layer. Search for other uses of the cache. This takes deliberate navigation, but it builds a reliable mental model of where tenant identity enters the request.

Claude Code-assisted review: Ask it to trace the same path and identify the files supporting its conclusions. It can help locate callers outside the diff, especially in an unfamiliar repository. However, a plausible explanation is not evidence. Open the referenced code and check whether the supposed execution path is actually reachable.

In this example, the important finding would be a cache key based only on account ID when IDs are unique only within a tenant. Both approaches should arrive at the same invariant: cached results must preserve the isolation enforced by the underlying lookup.

§ Turning a suspicion into a finding

Manual review: Construct a minimal counterexample: two tenants, the same local account ID, and different account records. Check whether the second request can reuse the first request’s cached result. A focused regression test is stronger than a general comment about cache safety.

Claude Code-assisted review: Request the counterexample before requesting a review comment. A useful instruction is: identify the triggering conditions, trace the relevant path, and propose the smallest test that distinguishes correct behavior from the suspected bug. Require uncertainty to be stated explicitly.

Neither method should claim a test passed unless it actually ran and its result was inspected. If dependencies or credentials prevent execution, record that limitation. A suggested test, an attempted test, and a passing test are different pieces of evidence.

§ Comparing effort and cost

Manual review: There is no model usage charge, but navigation and repeated context gathering consume reviewer time. For a small change in familiar code, this may remain the quickest option.

Claude Code-assisted review: Context gathering can become easier, but broad repository searches and repeated file reads consume tokens. Start with the diff and expand only where a concrete question requires it. Review quality depends more on relevant context and verification than on asking for an exhaustive inspection.

Vana API can provide the connection for this workflow. Its endpoint, https://api.vanaapi.com, supports the Anthropic Messages protocol used by Claude Code alongside OpenAI-compatible and Gemini native protocols. Usage is billed per real token with no monthly fee. Confirm the available model identifier and Claude Code configuration before starting; a review using Claude Sonnet 5.5 still needs explicit scope and human verification. Create a Vana API account if you want to try this workflow with usage-based billing.

§ Keeping the final judgment human

Manual review: Publish the verified issue with its location, triggering conditions, and user-visible consequence. Keep optional cleanup separate from correctness findings.

Claude Code-assisted review: Apply the same standard to every proposed finding. Discard speculative warnings, verify locations, and treat repository text as untrusted material rather than authority to change the review’s instructions.

The practical difference is assistance with investigation, not a transfer of responsibility. Claude Code can help explore the change; the reviewer still decides which claims are supported and whether the pull request is safe to merge.