SuiteScript Code Review Checklist (Free, Printable)

0%

0 of 29 items complete

6 critical items still open - these are the highest-risk gaps.

Download checklist:

Structure and style

JSDoc header declares @NApiVersion, @NScriptType and @NModuleScopeOnly the entry points the script needs are exportedModules are loaded through define and only those that are usedNo hard-coded internal IDs; values come from script parameters or constantsFunctions are small and named for what they doScript ID and file names follow the team convention

Governance and performance

No record.load or search inside loops where a single search would doCRITICALSearch results are paged or run with a page size appropriate to volumeCRITICALRemaining governance is checked in long loops with runtime.getCurrentScript()Field lookups use search.lookupFields instead of loading the full record where possibleSubmit uses submitFields for single-field updates when suitableBatch jobs use map/reduce or a rescheduling pattern, not one long scheduled runExpected volumes were tested with realistic data

Error handling and logging

Entry points wrap risky work in try/catchCRITICALErrors are logged with record type, internal ID and messageUser event scripts do not block saves unless blocking is the intentLog levels are sensible: no debug logging of every row in productionMap/reduce summarize stage reports input, map and reduce errorsSensitive data such as tokens or personal details is never loggedCRITICAL

Context and security

Script checks runtime.executionContext and skips CSV import or integration contexts if requiredExecute-as role has only the permissions neededSuitelets and RESTlets validate inputs and check the caller's permissionsCRITICALNo credentials stored in script files; use secrets or script parameters designed for thisExternal calls use HTTPS and handle timeouts and non-200 responses

Deployment and support

Deployment audience, subsidiaries and status are correctScript parameters are documented with defaultsTested in sandbox with the same role as production usersCRITICALRollback steps are writtenOwner and support contact are recorded

Aim to clear every critical item before release. Items outside your design (for example no Suitelets in a scheduled script) can be marked as not applicable.

Private AI code review

Optional: ask how a private, on-premises assistant could review scripts against your standards.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through each group while reading the code and the deployment record together. Tick items as you confirm them, not as you assume them. Critical items are the ones that most often cause outages or data problems; do not release with any of them open. Export the completed list to attach to the change ticket so the review leaves a record.

Review code and deployment together
Run the script in sandbox with realistic data before ticking performance items
Record who reviewed and when
Keep a shared list of recurring findings

Governance in practice

Each SuiteScript API call consumes governance units, and each script type has its own allowance. Loading a record costs more than a lookup, and doing it inside a loop multiplies the cost. Reviewers should look for loads, searches and saves inside iteration and ask what happens at ten times today's volume. Check the NetSuite help for the current unit costs and limits, since they are published per API and can change.

Common mistakes

Frequent review findings are scripts that fail silently because errors are caught and never logged, user events that run during imports and double-process records, and hard-coded internal IDs. Another is the deployment left in Testing status. Reviewers should also ask whether a saved search, workflow or built-in feature would meet the requirement without code at all.

Empty catch blocks
Scripts that ignore the execution context
Hard-coded IDs and role names
No owner after the developer leaves

Frequently Asked Questions

Does this apply to SuiteScript 1.0?

Most items about governance, error handling and security still apply, but the module and entry point items are specific to SuiteScript 2.x. Consider planning a migration of 1.0 scripts as part of your technical debt work.

Who should run the review?

Someone other than the author who understands both the code and the business process. For small teams, a structured self-review with this list is better than none, followed by a peer spot check.

How strict should we be on critical items?

Treat them as release blockers. They are chosen because failures in these areas cause user-visible errors, data corruption or security exposure.

Can I add my own items?

Export the list to Excel or Word and extend it with your team's rules, such as naming conventions or required unit test coverage.

If you want an AI assistant that reviews SuiteScript against your own standards on-premises, Netray can help build one.

Talk to an Expert Explore More Free Tools

Related Tools

NetSuite

More NetSuite tools

See all

SuiteScript Code Review Checklist