You are a senior software engineer reviewing a pull request.

## PR Information
- Title: {pr_title}
- Description: {pr_description}
- Files changed: {list_of_files}
- Lines added: {lines_added}
- Lines removed: {lines_removed}

## Diff
{git_diff}

Analyze this PR and provide:
1. ONE SENTENCE summary of what this PR does
2. List of files changed and WHY each was modified
3. Any files that were modified but seem unrelated to the PR purpose
4. A risk assessment (Low/Medium/High) with reasoning

Continuing with the same PR, now perform a thorough bug analysis.

Check for:
1. **Logic errors** — off-by-one, wrong conditions, missing edge cases
2. **Null/undefined handling** — any place where a value could be null/undefined
3. **Race conditions** — concurrent access, async timing issues
4. **Resource leaks** — unclosed connections, missing cleanup, memory leaks
5. **Error handling** — unhandled promise rejections, swallowed errors
6. **Data integrity** — partial updates, inconsistent state, missing transactions

For each issue found:
- File and line number
- Severity: 🔴 Critical / 🟡 Warning / 🔵 Suggestion
- What the bug is
- Why it's a problem (real scenario)
- Suggested fix (code snippet)

Now perform a security-focused review of this PR.

Check for:
1. **Injection attacks** — SQL injection, XSS, command injection
2. **Authentication/Authorization** — missing auth checks, privilege escalation
3. **Data exposure** — sensitive data in logs, responses, or error messages
4. **Input validation** — missing validation, type coercion issues
5. **Dependency risks** — new packages added, known vulnerabilities
6. **Secrets** — hardcoded credentials, API keys, tokens
7. **CORS/misconfiguration** — overly permissive headers, settings

Rate each finding: 🔴 Critical / 🟡 Warning / 🔵 Info
Provide specific remediation for each.

Now review this PR for performance issues.

Check for:
1. **N+1 queries** — database calls inside loops
2. **Missing indexes** — queries that would benefit from indexes
3. **Unnecessary re-renders** — React component optimization issues
4. **Memory inefficiency** — large arrays, unnecessary cloning, closure leaks
5. **Blocking operations** — synchronous I/O, heavy computations on main thread
6. **Pagination** — endpoints that load all records instead of paginating
7. **Caching opportunities** — repeated identical computations or queries

For each issue:
- Where it is (file:line)
- Impact: 🟡 Moderate / 🔴 High
- How to fix it (code example)
- Estimated performance improvement

Based on all reviews above, generate a final scorecard:

## PR Scorecard

**Overall Assessment:** [Approve / Request Changes / Comment]

**Issues Summary:**
- 🔴 Critical: {count}
- 🟡 Warnings: {count}
- 🔵 Suggestions: {count}

**Strengths:**
- [What the PR does well]

**Must Fix Before Merge:**
- [Only critical/warning items]

**Nice to Have:**
- [Suggestions for future improvement]

**One-line review comment for the author:**
[Constructive, specific feedback]

// BEFORE AI review - looks fine at first glance
async function deleteUsers(userIds) {
  for (const id of userIds) {
    await db.query('DELETE FROM users WHERE id = $1', [id]);
  }
  return { success: true };
}

async function deleteUsers(userIds) {
  const result = await db.transaction(async (tx) => {
    await tx.query('DELETE FROM audit_logs WHERE user_id = ANY($1)', [userIds]);
    await tx.query('DELETE FROM sessions WHERE user_id = ANY($1)', [userIds]);
    await tx.query('DELETE FROM orders WHERE user_id = ANY($1)', [userIds]);
    const { rowCount } = await tx.query('DELETE FROM users WHERE id = ANY($1)', [userIds]);
    return rowCount;
  });
  return { success: true, deleted: result };
}

// Middleware that "validates" admin access
function requireAdmin(req, res, next) {
  if (req.user.role === 'admin') {
    next();
  }
}

// Dashboard endpoint that loads user analytics
app.get('/api/dashboard', async (req, res) => {
  const users = await db.query('SELECT * FROM users');
  const dashboardData = await Promise.all(
    users.rows.map(user => 
      db.query('SELECT * FROM analytics WHERE user_id = $1', [user.id])
    )
  );
  res.json(dashboardData);
});

app.get('/api/dashboard', async (req, res) => {
  const dashboardData = await db.query(`
    SELECT u.id, u.name, a.* 
    FROM users u
    JOIN analytics a ON a.user_id = u.id
    WHERE u.created_at > NOW() - INTERVAL '30 days'
  `);
  res.json(dashboardData.rows);
});