How to tell Claude Code Review what to flag and what to skip with REVIEW.md

The Claude Code team shared how it does code review on October 26. Claude reviews every PR first, and a REVIEW.md at the repository root says what to flag and what to skip. The Code Review service reads this file; it's available on Team and Enterprise plans.

1. Create REVIEW.md at your repository root. It's freeform Markdown. It doesn't change how review comments look, only what the review looks for and reports.

# Review instructions

## What Important means here

Reserve Important for findings that would break behavior, leak data,
or block a rollback. Style, naming, and refactoring suggestions are Nit
at most.

## Cap the nits

Report at most five Nits per review.

## Do not report

- Anything CI already enforces: lint, formatting, type errors
- Generated files under `src/gen/` and any `*.lock` file

## Always check

- New API routes have an integration test
- Log lines don't include email addresses, user IDs, or request bodies

1. Merge it into your default branch and protect that branch. A review reads REVIEW.md from the pull request's base branch or the default branch, never from the PR's own changes, so merge rule changes first. Lowering severity, excluding paths and capping Nits are honored only when REVIEW.md is read from a protected default branch. On the default branch, either a classic branch protection rule or a ruleset counts as protection.

2. When the rules grow long, split them into files and pull each one into the root REVIEW.md with a line containing only @ and the file name. Keep the included files beside REVIEW.md, at most eight of them, and under 150,000 bytes combined with REVIEW.md. If REVIEW.md is read from an unprotected branch, the @ line stays as plain text.

# Review instructions

Report at most five Nits per review.

@review-security.md
@review-api.md

A REVIEW.md in a subdirectory adds checks for changes under that path on top of the root file. If the review keeps posting wrong findings, require evidence, for example "behavior claims need a file:line citation in the source, not an inference from naming."

The local /code-review command reads only your CLAUDE.md files, not REVIEW.md. Put rules you want applied in both places in CLAUDE.md, and keep REVIEW.md for pull request review only. The Claude Code team says that when the reviewer keeps flagging the same issue, they fix it at the source: in a skill, a lint rule, CLAUDE.md or REVIEW.md.