Generic AI reviewers are built to read any diff on GitHub. That is the problem. They read a .svelte file like plain JavaScript. The syntax checks out, so they wave it through, and they miss the bugs that come from how Svelte and SvelteKit actually run. Those bugs compile, pass review, and break in production.
Why a framework-blind reviewer misses the real bugs
A reviewer that only sees JS syntax cannot reason about what runs on the server versus the client, what is reactive, or what ends up in the browser bundle. That is where SvelteKit bugs live. Here are the ones I kept hitting.
1. Server-only env reaching the client
Importing a secret straight into a component usually gets caught at build. The sneaky version does not: a secret pulled in a universal load and returned to the page, or a PUBLIC_ prefix on a var that should have stayed private. The diff looks fine and the secret is now in your client bundle.
2. window or localStorage at module top level
localStorage.getItem(...) or window.x at the top of a component runs on the server during SSR, where those globals do not exist. You get a ReferenceError and a blank page. A generic reviewer sees valid JavaScript and says nothing.
3. $effect where $derived belongs
In Svelte 5, using $effect to compute a value that should be $derived gives you stale UI. It compiles, it runs, it is wrong, and the linter stays green.
SOCIAL SHARE CARD GENERATOR