# SuiteScript Code Review Checklist > Source: https://netray.co/tools/suitescript-code-review-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A practical review checklist for SuiteScript 2.x covering structure, governance, error handling, security and deployment. ## Category netsuite ## Erp NetSuite ## Audience - NetSuite developer - Technical reviewer - NetSuite technical lead ## Tool **Kind:** checklist **Groups:** #### Structure and style **Items:** JSDoc header declares @NApiVersion, @NScriptType and @NModuleScope Only the entry points the script needs are exported Modules are loaded through define and only those that are used No hard-coded internal IDs; values come from script parameters or constants Functions are small and named for what they do Script ID and file names follow the team convention #### Governance and performance **Items:** **Text:** No record.load or search inside loops where a single search would do **Critical:** true **Text:** Search results are paged or run with a page size appropriate to volume **Critical:** true Remaining governance is checked in long loops with runtime.getCurrentScript() Field lookups use search.lookupFields instead of loading the full record where possible Submit uses submitFields for single-field updates when suitable Batch jobs use map/reduce or a rescheduling pattern, not one long scheduled run Expected volumes were tested with realistic data #### Error handling and logging **Items:** **Text:** Entry points wrap risky work in try/catch **Critical:** true Errors are logged with record type, internal ID and message User event scripts do not block saves unless blocking is the intent Log levels are sensible: no debug logging of every row in production Map/reduce summarize stage reports input, map and reduce errors **Text:** Sensitive data such as tokens or personal details is never logged **Critical:** true #### Context and security **Items:** Script checks runtime.executionContext and skips CSV import or integration contexts if required Execute-as role has only the permissions needed **Text:** Suitelets and RESTlets validate inputs and check the caller's permissions **Critical:** true No credentials stored in script files; use secrets or script parameters designed for this External calls use HTTPS and handle timeouts and non-200 responses #### Deployment and support **Items:** Deployment audience, subsidiaries and status are correct Script parameters are documented with defaults **Text:** Tested in sandbox with the same role as production users **Critical:** true Rollback steps are written Owner and support contact are recorded **Scoring Note:** Aim to clear every critical item before release. Items outside your design (for example no Suitelets in a scheduled script) can be marked as not applicable. ## Content **Intro:** A review checklist stops the same SuiteScript defects from reaching production. Use this list in pull requests or peer review to check structure, governance, error handling, security and deployment before a script is released. **Sections:** #### How to use the checklist **Body:** Work through each group while reading the code and the deployment record together. Tick items as you confirm them, not as you assume them. Critical items are the ones that most often cause outages or data problems; do not release with any of them open. Export the completed list to attach to the change ticket so the review leaves a record. **Bullets:** - Review code and deployment together - Run the script in sandbox with realistic data before ticking performance items - Record who reviewed and when - Keep a shared list of recurring findings #### Governance in practice **Body:** Each SuiteScript API call consumes governance units, and each script type has its own allowance. Loading a record costs more than a lookup, and doing it inside a loop multiplies the cost. Reviewers should look for loads, searches and saves inside iteration and ask what happens at ten times today's volume. Check the NetSuite help for the current unit costs and limits, since they are published per API and can change. #### Common mistakes **Body:** Frequent review findings are scripts that fail silently because errors are caught and never logged, user events that run during imports and double-process records, and hard-coded internal IDs. Another is the deployment left in Testing status. Reviewers should also ask whether a saved search, workflow or built-in feature would meet the requirement without code at all. **Bullets:** - Empty catch blocks - Scripts that ignore the execution context - Hard-coded IDs and role names - No owner after the developer leaves **Cta:** If you want an AI assistant that reviews SuiteScript against your own standards on-premises, Netray can help build one. **Faq:** #### Does this apply to SuiteScript 1.0? **Answer:** Most items about governance, error handling and security still apply, but the module and entry point items are specific to SuiteScript 2.x. Consider planning a migration of 1.0 scripts as part of your technical debt work. #### Who should run the review? **Answer:** Someone other than the author who understands both the code and the business process. For small teams, a structured self-review with this list is better than none, followed by a peer spot check. #### How strict should we be on critical items? **Answer:** Treat them as release blockers. They are chosen because failures in these areas cause user-visible errors, data corruption or security exposure. #### Can I add my own items? **Answer:** Export the list to Excel or Word and extend it with your team's rules, such as naming conventions or required unit test coverage. ## Search terms suitescript code review checklist, netsuite script review, suitescript best practices, netsuite script governance review, suitescript 2.1 review, netsuite peer review checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json