Gemini for Developers: Code Generation and Code Review — Real Productivity, Not Just Hype

Still spending hours writing boilerplate, hunting for snippets on Stack Overflow, or doing code reviews manually? That's the typical developer grind. Gemini, Google's model, can cut that time drastically — but used without caution, you risk embedding insecure or semantic wrong code. At Meteora Web, we work daily with PHP, Laravel, Livewire, JavaScript, and we actively use Gemini for code generation and review. Here we share hands-on experience: how to leverage Gemini for code generation and code review without losing control, with real prompts and concrete metrics.

Why use Gemini for code generation and code review over other tools?

GitHub Copilot, ChatGPT, Claude… choices abound. Gemini stands out for its native integration with Google's ecosystem (Vertex AI, Colab, Android Studio) and its ability to handle long contexts (up to 2 million tokens in some versions). If you already work on GCP or with Google APIs, lower latency and data consistency make it a solid pick. We tested it on a Laravel project to generate a full CRUD with validations and permissions: it produced 70% ready-to-use code, but we had to adapt authorization policies to our logic. The saving was real, but human oversight was essential.

How to write effective prompts for code generation with Gemini?

A vague prompt produces generic code. With Gemini, output quality depends on precision. Three rules we've validated on client projects:

• Specify context: language, framework, version. Example: "Generate a PHP 8.2 function that validates an email using filter_var and checks the domain with checkdnsrr."
• Give input/output examples: "For input 'test@example.com' return true, for 'test@esempio' return false."
• Request a structured format: "Return the code in a single block with inline comments."

Practical example. Prompt:

Generate a PHP 8.2 function that takes an email string and returns true if the email is valid and the domain has a valid MX record. Use filter_var and getmxrr. Include error handling with try-catch.

Gemini output (after verification):

function validateEmailWithMX(string $email): bool
{
    try {
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            return false;
        }
        $domain = substr(strrchr($email, "@"), 1);
        if (!checkdnsrr($domain, "MX")) {
            return false;
        }
        return true;
    } catch (\Exception $e) {
        error_log("Email validation error: " . $e->getMessage());
        return false;
    }
}

Note: Gemini omitted the getmxrr fallback (it used checkdnsrr, which is correct but less granular). We added a fallback for higher accuracy. The output is a springboard, not the final product.

Can Gemini replace a human code review?

Short answer: no. Long answer: it can augment it, cutting review time by 30–40%. Gemini catches common bug patterns (null pointers, uninitialized variables, SQL injection if prompted), but it misses architectural violations, consistency with company policies, or domain-specific performance issues. We use it as a first automatic pass before manual review. Example code review prompt:

Analyze this JavaScript code and flag potential security vulnerabilities, unwanted global variables, performance issues, and ES2021 best practice violations.

Gemini returns a list of observations. Our follow-up checks show a false-positive rate of ~15% (flags things that are actually fine) and a false-negative rate around 20% (misses real issues). Human eyes are still needed, but the first pass saves time.

What are the risks and limitations of Gemini for code generation?

Three concrete risks we've encountered in client projects (and faced ourselves):

1. Unsafe code: Gemini may generate non-parameterized SQL or use deprecated functions. Always verify with static analysis tools (PHPStan, ESLint, Snyk).
2. Hallucinations about APIs and libraries: it sometimes invents functions or packages that don't exist. In our Laravel test, it suggested `app()->make()` with wrong parameters — we had to fix.
3. Lack of business context: technically valid code may not align with your domain logic — e.g., discount calculations based on seasons (common for our retail clients). The code needed adaptation to the business model.

To mitigate: use prompts that ask for explanatory comments, test the output in a dev environment, and never integrate into production without manual review.

What to do now: first code review prompt with Gemini

If you haven't used Gemini for code review yet, start with this tested prompt for small files. Open the Gemini interface (ai.google.dev) or use the API via Python:

import google.generativeai as genai

genai.configure(api_key="YOUR_API_KEY")
model = genai.GenerativeModel('gemini-2.0-flash')

code = '''
function getTotal(items) {
  let total = 0;
  for (let i = 0; i < items.length; i++) {
    total += items[i].price;
  }
  return total;
}
'''

prompt = f"""Perform a code review of the following JavaScript code. Flag:
- potential bugs
- performance issues
- security violations
- best practices not followed. Use a bullet-point format.

Code:
{code}
"""

response = model.generate_content(prompt)
print(response.text)

The result will point out, for example, missing null handling for `items`, the loop could be optimized with `reduce`, and lack of data validation. From there you improve the code before manual review.

In our workflow, this step saves on average 35% of review time. Then a senior developer verifies and adjusts. The outcome: more robust code and faster deliveries.

For deeper integration of Gemini into your projects, check our pillar on Gemini and Google AI.