diff --git a/README.md b/README.md
index 0eaf9f3..1c1f51c 100644
--- a/README.md
+++ b/README.md
@@ -271,6 +271,10 @@ Things we scoped out for this version but would build next:
 
 ## AI Use Disclosure
 
+<!-- REVIEW: "-Julian" reads like a signature but it's placed before the section
+     it's attributing, not after (compare to "- Sean" further down, which
+     correctly follows his section). Worth moving below the paragraph it belongs to. -->
+
 -Julian
 
 I used an AI assistant (Claude Code, by Anthropic) during development, primarily as a **mentor/tutor rather than a code generator**.
diff --git a/db/config.js b/db/config.js
index c8688d0..3f7cf08 100644
--- a/db/config.js
+++ b/db/config.js
@@ -1,6 +1,9 @@
 import { MongoClient } from "mongodb";
 import dotenv from "dotenv";
 
+// REVIEW: leftover from before the project was renamed to ClubSync? Worth
+// updating to match (or a comment noting it's intentional to avoid a DB
+// migration), since the name shows up in package.json too.
 export const DB_NAME = "group-sync";
 dotenv.config();
 const DEFAULT_URI = process.env.MONGO_URI;
diff --git a/db/users-db.js b/db/users-db.js
index fef4339..380fd91 100644
--- a/db/users-db.js
+++ b/db/users-db.js
@@ -43,6 +43,9 @@ function UsersCollection({ collectionName = "users" } = {}) {
         phoneNumber,
         duesStatus: DUES_STATUS.NOT_SUBMITTED,
         groupId: null,
+        // REVIEW: this is the string "null", not the null value used right above
+        // for groupId — was that intentional? A strict `=== null` check on
+        // duesTier elsewhere in the codebase would silently fail against this.
         duesTier: "null",
         duesAmount: null,
         discount: null,
diff --git a/desgin/DESIGN.md b/desgin/DESIGN.md
index a4d5e34..678c24b 100644
--- a/desgin/DESIGN.md
+++ b/desgin/DESIGN.md
@@ -1,3 +1,5 @@
+<!-- REVIEW: the containing folder is named "desgin" — looks like a typo for "design". -->
+
 # ClubSync — Design Document
 
 **Team:** Sean Behan, Julian Leonhardt
diff --git a/frontend/src/pages/member/member-dashboard/group-widget/GroupWidget.jsx b/frontend/src/pages/member/member-dashboard/group-widget/GroupWidget.jsx
index 6e3f42d..e8d5417 100644
--- a/frontend/src/pages/member/member-dashboard/group-widget/GroupWidget.jsx
+++ b/frontend/src/pages/member/member-dashboard/group-widget/GroupWidget.jsx
@@ -54,6 +54,8 @@ export default function GroupWidget() {
       if (!res.ok) {
         const data = await res.json().catch(() => ({}));
         setError(data.message ?? "Could not leave the club.");
+        // REVIEW: unlike the line above, this has no fallback — if res.json()
+        // fails and data is {}, this shows a "danger" toast with undefined text.
         showToast(data.message, "danger");
         return;
       }
diff --git a/middleware/auth.js b/middleware/auth.js
index 478022a..2300874 100644
--- a/middleware/auth.js
+++ b/middleware/auth.js
@@ -14,6 +14,8 @@ const ROLE_RANK = { member: 1, treasurer: 2, admin: 3 };
 // requireRole("treasurer") RETURNS a middleware that allows treasurer and above.
 // The inner function is what Express actually runs per request; it "remebers"
 // minRole via closure
+// REVIEW: typo "remebers" -> "remembers"; also the 401 message below has a
+// trailing space ("Not authenticated ") that doesn't match the one on line 8.
 
 export const requireRole = (minRole) => {
   return (req, res, next) => {